AI-powered smart contract security auditor for Hardhat. Automatically finds vulnerabilities before deployment.
npm install hardhat-blockhertzBlockhertz Hardhat Plugin integrates AI-powered smart contract security auditing directly into your Hardhat development workflow. Run automated vulnerability scans on every compile or test — catching reentrancy, integer overflow, access control issues, and more before deployment. Supports Solidity and works with Ethereum, Polygon, Base, Arbitrum, and other EVM networks. Free to use, no signup required.
0.3.1
Current Version
Free
Forever
MIT
License
Hardhat 3
Compatible
Three commands from install to a passing build.
npm install hardhat-blockhertzAdd plugin to hardhat.config.ts
npx hardhat blockhertz-auditPlugin scans all .sol files
Review findings by severityFix issues before deployment
Six vulnerability classes across the OWASP smart-contract top-10 plus gas hygiene.
Detects CEI pattern violations and unprotected external calls
Finds missing modifiers and unprotected privileged functions
Identifies spot price oracle usage vulnerable to flash loans
Flags unsafe math operations outside Solidity 0.8+
Suggests storage, loop and memory usage improvements
Catches zero address checks, input validation gaps and more
Copy the snippets below, run three commands, done.
npm install hardhat-blockhertz
The failOn option controls when the plugin fails your build.
| Value | Behavior | Best For |
|---|---|---|
"critical" | Fail on critical only | Production quick check |
"high" | Fail on high + critical | Recommended default |
"medium" | Fail on medium and above | Strict security |
"none" | Never fail build | Audit-only mode |
Add security auditing to every pull request. Blocks merges when critical vulnerabilities are found.
# --yes skips the interactive prompt in non-TTY CI environments
- name: Security Audit
run: npx hardhat blockhertz-audit --yes
env:
BLOCKHERTZ_API_KEY: ${{ secrets.BLOCKHERTZ_API_KEY }}Documentation
blockhertz.com/tools/hardhat-plugin/docs
npm Package
npmjs.com/package/hardhat-blockhertz
GitHub Repository
github.com/Blockhertz/hardhat-blockhertz
Get API Key
blockhertz.com/tools/dashboard/api-keys
AI Auditor Tool
blockhertz.com/tools/ai-auditor
Telegram Audit Bot
t.me/blockhertz_audit_bot
hardhat-blockhertz is free and open-source. Audits consume Blockhertz API credits.
Free
$0
Get Started
Starter
$19
One-time
Unlimited
$99/mo
Per month
Each npx hardhat blockhertz-audit run on one contract = 1 credit. Free API key at blockhertz.com/tools/dashboard/api-keys.
Get your free API key and install hardhat-blockhertz in 30 seconds.
Get Free API KeyFAQ
hardhat-blockhertz is a free open-source Hardhat 3 plugin that automatically audits Solidity smart contracts for security vulnerabilities using the Blockhertz AI Security API. Install with `npm install hardhat-blockhertz`, add it to your hardhat.config.ts plugins array, and run `npx hardhat blockhertz-audit`.
Yes. The hardhat-blockhertz plugin is MIT-licensed and free to install from npm. It uses the Blockhertz AI Security API — free-tier API keys include up to 3 audits per day. Create a free API key at blockhertz.com/tools/dashboard/api-keys.
hardhat-blockhertz detects six classes of smart contract issues: reentrancy attacks, access control failures, oracle manipulation, integer overflow, missing input validations, and gas optimization opportunities. Each finding is tagged with a severity (critical, high, medium, info) so you can fail the build on the threshold you choose.
Use the `failOn` option in hardhat.config.ts under the `blockhertz` config object. Values: "critical" fails on critical findings only, "high" fails on high + critical (recommended default), "medium" fails on medium and above (strict), or "none" never fails the build (audit-only).
Yes. Add `npx hardhat blockhertz-audit --yes` to your GitHub Actions, GitLab CI, or any CI pipeline. The `--yes` flag skips the interactive confirmation prompt. Set BLOCKHERTZ_API_KEY as a secret and the plugin blocks merges when critical vulnerabilities are found.
hardhat-blockhertz is compatible with Hardhat 3 and requires Node.js 22 or higher. See the full documentation at blockhertz.com/tools/hardhat-plugin/docs for install prerequisites and troubleshooting.
Yes. The plugin integrates with GitHub Actions, GitLab CI, and other CI/CD systems. Configure failOn to block deployments when Critical or High vulnerabilities are detected.
Yes. The plugin is free and open source. It uses your Blockhertz API key — free tier included, no credit card required.