Krait
AI-assisted security verification for Solidity smart contracts. Not a scanner — a structured methodology with 101 heuristics, 26 analysis modules, and 8 kill gates. In its last measured version (v8) it reported 10 true positives and 0 false positives on a 5-contest blind batch of past Code4rena contests, while finding 15.2% of the known High/Medium issues (how this was measured). Runs inside Claude Code. Free.
At a Glance
| |
|---|
| Current version | v8.2 (kill-gate parity, Impact Premise, rescan + per-contract recall phases) |
| Measured baseline | v8 — five contests (numbers 46–50 in the historical registry). v8.1/v8.2 are not yet re-measured (why) |
| Detection angles | 16 per function (4 lenses × 4 mindsets) |
| Heuristics | 43 original + 58 extended (from open-source community) |
| Analysis modules | 15 deep-dive module files + 26 inline modules (A-X) |
| Audit-trail rules | R8 / R10 / R11 / R12 / R15 / R16 — exercised per finding (v8.1) |
| Domain primers | 7 (DEX, Lending, Staking, GameFi, Bridges, Proxies, Wallets) |
| Kill gates | 8 automatic + Impact Premise + 10 FP patterns (identical on both surfaces, parity-tested) |
| Shadow audits | v8: 10 TPs / 0 FPs, 15.2% recall on 5 contests. All 50 contests, v1–v8 pooled: ≈49% precision |
| Full methodology | METHODOLOGY.md — every technique, publicly documented |
Two Local Surfaces, One Web Platform
This repo ships two Claude Code surfaces. They answer different questions, and you can run either or both.
| Audit pipeline (/krait) | Checklist plugin (/krait:scan) |
|---|
| Question it answers | "What bugs are in this code?" | "Am I ready for an audit?" |
| Method | Multi-phase adversarial reasoning from first principles | 845 curated checks across 39 DeFi verticals |
| Output | Exploit traces with file:line, severity, suggested fix | Per-check verdicts, importable assessment JSON |
| Bar | Zero false positives — 8 kill gates try to disprove every finding | Coverage — every applicable check gets a verdict |
| Lives in | .claude/, src/ | checklist/ |
| Install | ./scripts/install.sh | /plugin marketplace add ZealynxSecurity/krait |
Use the checklist to find out where you stand before an audit; use the audit pipeline to find the actual bugs.
Web platform (krait.zealynx.io) — AI-assisted security verification with per-check prompt generation, auto-parsed verdicts, shareable reports, and PDF export. Both local surfaces produce output you can upload to it. Also free.
┌─────────────────────────────────────────────────────────────────────────┐
│ /krait (local) krait.zealynx.io (web) │
│ ───────────── ──────────────────── │
│ Run audit in Claude Code 845+ checks across 39 DeFi types │
│ 4-phase pipeline "Verify with AI" per check │
│ Findings with exploit traces ├─ Generates tailored prompt │
│ .audit/krait-findings.json ├─ Run in any IDE AI │
│ │ ├─ Paste response back │
│ └──► Upload to dashboard └─ Auto-detect verdict + files │
│ Shareable reports Shareable reports + PDF export │
│ Track over time Combined readiness score │
└─────────────────────────────────────────────────────────────────────────┘
Built by Zealynx Security — 30+ DeFi protocol audits.
What Krait Does
Krait is a structured audit methodology encoded as Claude Code skills. When you run /krait on a Solidity project, it executes a 4-phase pipeline:
- Recon — maps the architecture, extracts the AST, scores every file by risk, selects protocol-specific detection primers
- Detection — analyzes each high-risk function from 16 angles (4 technical lenses x 4 independent mindsets), with consensus scoring across passes
- Rescan — a second broad pass told exactly what pass 1 found, so its attention goes to the gaps. Skips itself if pass 1 found nothing above Informational
- Per-contract — one agent per inheritance cluster at maximum depth, countering the dilution that makes a whole-codebase agent skim everything after the two most interesting files
- State Analysis — finds coupled state pairs and mutation patterns that per-function scanning misses
- Verification — 8 kill gates try to disprove every finding, and the Impact Premise gate demands a harm statement (WHO loses WHAT) before any trace. Only findings with a concrete exploit trace survive
The output is a structured report with findings at exact file:line locations, vulnerable code, suggested fixes, and exploit traces. Saved as both markdown and JSON.
What Krait Is Not
- Not a linter or regex scanner — Claude reads and reasons about code
- Not a SaaS product with API costs — runs locally in your Claude Code session
- Not a replacement for a professional audit — it's a tool that catches real bugs before your auditor does
Quick Start
Requirements
- Claude Code (CLI, VS Code extension, or Cursor)
- A Claude subscription (Pro, Max, or Team)
- A Solidity project to audit
Install
git clone https://github.com/ZealynxSecurity/krait.git
cd krait && ./scripts/install.sh
That single command:
- copies the commands and skills into
~/.claude/
- builds both bundled MCP servers
- registers them with Claude Code at user scope, so they work in every project — not just inside this clone
Open Claude Code in any Solidity project and run /krait. No API keys needed for any of it.
Preview without touching anything: ./scripts/install.sh --dry-run.
Skip the MCP servers entirely: ./scripts/install.sh --no-mcp (the skills work fine without them).
Update
cd krait && git pull && ./scripts/install.sh
Re-running the installer is safe and idempotent — it refreshes the skills and re-points the
MCP registration at this clone's current path.
The MCP servers
| Server | What it adds | Used by |
|---|
krait-solodit | Local search over the Solodit-derived vulnerability patterns in patterns/ | Detection |
krait-forge | forge build / test / fmt-check without round-tripping shell output | /krait-fuzz, PoC verification |
Both are optional, run locally, and need no API key. If you'd rather wire them by hand:
npm run mcp:build # build only
claude mcp add krait-solodit --scope user -- node "$PWD/mcp-servers/solodit/build/index.js"
claude mcp add krait-forge --scope user -- node "$PWD/mcp-servers/forge/build/index.js"
npm install in the clone also builds them via a postinstall step (set
KRAIT_SKIP_MCP_BUILD=1 to opt out). Run /krait-init at any time to see what's wired up.
Commands
| Command | What it does |
|---|
/krait | Full 4-phase audit: Recon → Detection → State Analysis → Verification → Report (auto-runs preflight first) |
/krait-quick | Same pipeline, skips state analysis — ~2x faster |
/krait-review | Second opinion on killed findings — re-examines aggressive gate decisions |
/krait-fuzz | Invariant extraction → Foundry test generation → run/fix loop |
/krait-init | Standalone readiness check (tools, project shape, MCP wiring). /krait runs this automatically; this command is for CI setup and debugging. |
/krait-poc | Write and run a Foundry PoC that proves an exploit by asserting the actual harm on a forked chain — or proves it does not reproduce. Emits [POC-PASS]/[POC-FAIL]. |
All output to .audit/ in your project directory.
Checklist commands (separate plugin)
Installed via the plugin marketplace rather than scripts/install.sh:
/plugin marketplace add ZealynxSecurity/krait
/plugin install krait@krait
(krait@krait = plugin krait from marketplace krait. Verified end to end with
claude plugin install; both manifests pass claude plugin validate.)
| Command | What it does |
|---|
/krait:scan | Quick scan — auto-detects the vertical, applies its checks |
/krait:assess | Full check-by-check assessment; emits .zealynx-run.json for the web platform |
/krait:check LN-01 | Deep analysis of a single framework check against your code |
845 checks across 39 verticals, derived from 4,500+ Solodit audit findings. Runs locally, no API key. See checklist/README.md.
After the Audit
Every run saves findings to .audit/krait-findings.json and shows:
───────────────────────────────────────────────────
📋 N findings saved to .audit/krait-findings.json
🔗 View this report online:
https://krait.zealynx.io/report/findings
📊 Track findings over time:
https://krait.zealynx.io/dashboard
───────────────────────────────────────────────────
Findings are already verified — the critic phase requires a concrete exploit trace for every H/M before it reaches the report.
If the critic killed many candidates, run /krait-review to get a second opinion on the gate decisions.
How Detection Works
Multi-Mindset Analysis (v7.0)
Each of the 4 detection lenses analyzes code through 4 independent mindsets simultaneously:
| Mindset | Question |
|---|
| Attacker | "How would I exploit this to drain funds or escalate privilege?" |
| Accountant | "Trace every wei — do the numbers add up?" |
| Spec Auditor | "Does the code match what docs, comments, and EIPs say it should do?" |
| Edge Case Hunter | "What breaks at zero, max, empty, self-referential, or reentrant?" |
Every function in high-risk files gets examined from 16 angles (4 lenses x 4 mindsets). Findings discovered by multiple mindsets get a consensus boost; single-source findings get extra scrutiny.
Kill Gates (Verification)
Eight automatic gates try to disprove every finding before it reaches you:
- A: Generic best practice ("use SafeERC20") · B: Theoretical/unrealistic
- C: Intentional design · D: Speculative (no WHO/WHAT/HOW MUCH)
- E: Admin trust · F: Dust (<$100) · G: Out of context · H: Known issue
Result: FPs dropped from 4.2/contest → 0.0/contest in v7 (100% reduction). The last 10 contests (v6.4+v7) had only 1 total FP across 10 contests.
Second Opinion (/krait-review)
The kill gates are aggressive by design — zero false positives is the priority. But aggressive gates can over-kill. Run /krait-review after an audit to re-examine killed findings with fresh eyes:
- Gate C (intentional design) — "intentional" doesn't always mean "safe"
- Gate E (admin trust) — missing timelocks and rug vectors are valid Mediums in many contests
- Gate B (theoretical) — retries exploit construction with flash loans, multi-block MEV
- Gate F (dust) — recalculates with protocol TVL context and accumulation analysis
Revived findings are surfaced as "Worth Manual Review" — flags for the auditor, not verified TPs. The main report's zero-FP standard is preserved.
Benchmarks
50 past Code4rena contests have been run blind, in batches of 3–10, each batch with a different methodology version. Every version's numbers are its own batch only; they are not cumulative. Selected versions:
| Version | Contests | Precision* | Recall | FPs/Contest |
|---|
| v1 | 1-3 | 12% | 5.8% | 1.3 |
| v5 | 31-35 | 70% | 9.5% | 0.6 |
| v6.4 | 36-40 | 90% | 11.8% | 0.2 |
| v7 | 41-45 | 100% | 11.0% | 0.0 |
| v8 | 46-50 | 100% | 15.2% | 0.0 |
* Mean of per-contest precision, over the contests in that batch that produced any finding (contests with no findings are left out). Pooled over findings, v6.4 is 7 true positives to 1 false positive (87.5%) and v8 is 10 to 0. Pooled over all 50 contests and all versions, including the early ones, precision is ≈49% (93.5 weighted true positives, 96 false positives). The v8 recall of 15.2% is pooled: 10 matches out of 66 official High/Medium issues.
Latest 5 contests (v8):
| Contest | Type | Official H+M | TPs | FPs | Precision | Recall |
|---|
| PoolTogether | ERC-4626 Prize Vault | 9 | 1 | 0 | 100% | 11% |
| GoodEntry | UniV3 Derivatives | 14 | 5 | 0 | 100% | 36% |
| Arcade | Governance/Voting | 8 | 2 | 0 | 100% | 25% |
| Frankencoin | CDP Stablecoin | 20 | 2 | 0 | 100% | 10% |
| InitCapital | Lending/Hooks | 15 | 0 | 0 | N/A | 0% |
Every result is verifiable in shadow-audits/.
How these numbers were measured
- Corpus: 50 public Code4rena contests from April 2023 to August 2024 (
shadow-audits/registry.yaml). One (Tangible Caviar) could not be scored because its findings were not public.
- Blind: no official findings are visible during a run. The contests' reports are public, though, so they are likely in the model's training data.
- Scoring: self-scored in Krait's records, with no outside review. The scoring template counts an exact match as 1, a partial match as 0.5, and an unmatched finding as a false positive. The current comparator uses heuristic matching by default and an AI judge only with
--ai-match; the registry does not identify which matcher scored each historical result.
- Per version: the methodology is tuned on each batch's misses and then run on a new batch of 3–10 contests (v5.1 re-ran v5's five), so each version is measured on its own batch only. Batches are small, so a single false positive moves a batch's precision by 10 points or more.
- Where the totals come from: the aggregate table in
shadow-audits/progress.md and the per-contest results in registry.yaml.
- Which surface: the current harness (
src/shadow/runner.ts) runs the CLI. The registry does not independently identify the surface that produced each historical result. Before v8.2 the CLI critic did not apply the skill's 8 kill gates (see v8.2 below).
v8 is the number Krait stands behind. v8.1 and v8.2 changed the methodology after that
measurement and have not been re-run over the registry. A 3-contest v8.1 pilot suggested a
large recall gain, but n=3 against two-month-old baselines is a hint, not a benchmark —
the figures and their caveats are quarantined in
METHODOLOGY.md § Unvalidated since the v8 baseline
rather than mixed into the table above.
Changes are gated mechanically:
npm run shadow:regress -- --contests neobase,opendollar --update # record a baseline
npm run shadow:regress -- --contests neobase,opendollar # gate a change
Any new false positive fails the gate. So does a recall drop worse than 2 percentage points.
Self-Improving
After each blind test: score → root-cause every miss → update methodology → re-test. This loop produced 43 original heuristics, 15 deep-dive module files, 58 extended heuristics, 26 inline modules, and 7 protocol-specific primers. v8 integrated open-source vectors from pashov/skills, PlamenTSV/plamen, and forefy/.context (all MIT). The recorded v8 five-contest batch had 10 matches, no false positives and 15.2% pooled recall; that sample does not isolate which change caused the result.
v8.1 (Tier A — methodology audit trail) adds six structured fields to every detector / state-auditor / critic finding: stepExecution (which lenses/phases/gates ran), rulesApplied (R8 cached params, R10 worst-state severity, R11 unsolicited token transfer, R12 enabler enumeration, R15 flash-loan precondition, R16 oracle integrity), depthEvidence ([BOUNDARY:…] / [VARIATION:…] / [TRACE:…] concrete-value tags), missingPrecondition / preconditionType, postconditionsCreated / postconditionTypes / whoBenefits. Rules and tags are derived from PlamenTSV/plamen's methodology framework, integrated under MIT.
v8.2 closes the gap between Krait's two surfaces and adds recall. The 8 kill gates, the DoS exception and the 10 FP patterns now live in the TypeScript CLI critic as well as the skill — previously the CLI ran a generic reviewer prompt with none of them, even though the benchmark harness runs the CLI. Gate attribution is enforced in code rather than requested in a prompt, and a parity test suite fails the build when the two surfaces drift. On top of that: the Impact Premise gate (a finding must state WHO loses WHAT, not just what the machinery does), two exclusion-list recall phases (rescan, per-contract), trust-assumption downgrade instead of outright dismissal, and root-cause consolidation in the report.
Neither v8.1 nor v8.2 has been re-measured across the 50-contest registry. The v8 numbers below remain the honest baseline until it is. The gate that will do the measuring ships with this version: npm run shadow:regress blocks on any new false positive and on a recall drop worse than 2 pp.
Real Bugs Found (Blind)
- ONE_HUNDRED_WAD constant bug (Open Dollar H-01) — surplus auction math inflated 100x, bricking protocol economics (v7, CONST-01 heuristic)
- Gauge removal locks voting power (Neobase H-01) — contradictory guards permanently trap user governance power (v7, GAUGE-01 heuristic)
- Zero slippage on all swaps (BakerFi H-04) — amountOutMinimum=0 enables sandwich on every deposit/withdraw (v7)
- Oracle staleness OR vs AND (BakerFi M-06) — stale price accepted if either feed is fresh (v7)
- slot0 manipulation in TokenisableRange (GoodEntry H-04) — flash loan manipulates UniV3 spot price, stealing depositor fees (v8, amm-mev-deep module)
- Voting power not synced on multiplier change (Arcade M-05) — stale inflated voting power after NFT boost update (v8, governance-voting Pashov vector)
- claimYieldFeeShares zeroes entire balance (PoolTogether H-01) — partial claim wipes all fee accounting (v8, erc4626-vault-deep module)
- Challenger reward drains reserves (Frankencoin H-06) — self-challenge extracts unlimited rewards (v8, economic-design module)
- AuraVault claim double-spend (LoopFi H-401) — fees not deducted, draining vault
- UniV3 fee drain via shared position (Vultisig H-43) — first claimer steals all fees
- ILO launch DoS (Vultisig H-41) — slot0 manipulation blocks all launches
- Public internals → permanent fund lock (Phi H-51) — state corruption locks ETH
- Both HIGHs (Munchables) — lockOnBehalf griefing + early unlock, 100% precision
- Assembly encoding bug (DittoETH M-221) —
add vs and corrupts data
- ERC4626 inflation (Basin), reentrancy (reNFT), EIP-712 mismatch (reNFT), oracle precision (Dopex), TVL error (Renzo)
Detection Coverage
Strong on: Reentrancy/CEI, access control gaps, oracle issues (Chainlink + Pyth), EIP/ERC compliance, first-depositor inflation, accounting errors, assembly bugs, pause bypasses, slot0/spot price manipulation, ERC-4626 vault accounting, governance voting power sync, AMM/MEV vectors
Improving: Complex math (CDP liquidation, options pricing), cross-chain edge cases, game mechanic exploits, custom hook/plugin architectures, protocol-specific integrations (Curve adapter edge cases)
Verify with AI (Unique Feature)
Every security check on the web platform generates a tailored AI prompt you can copy-paste into Claude Code, Cursor, Windsurf, or Codex. The prompt includes:
- The specific vulnerability to look for
- Real exploit examples from Solodit (protocols that were actually hacked)
- What secure code looks like (from mitigation data)
- Code patterns to grep for
- Structured output format (PASS/FAIL/NA with file:line references)
When you paste the AI's response back, Krait auto-parses it:
- Detects the verdict (PASS/FAIL/NOT APPLICABLE/NEEDS REVIEW)
- Extracts file:line references
- Scores confidence (high/medium/low)
- Auto-sets the check status
This turns every check from "do you think you're ok?" into "let's verify against your actual code with AI."
Upload & View Reports
Upload .audit/krait-findings.json at krait.zealynx.io/report/findings for a branded report with severity breakdowns, exploit traces, and code diffs. Share via persistent link or download as PDF.
Security Verification (845+ Checks)
AI-assisted security verification covering 39 DeFi verticals — each check backed by real Solodit exploit data, with "Verify with AI" prompts for every single one. Not a checklist you fill out manually — a verification pipeline that leverages your IDE's AI.
Start at krait.zealynx.io/new.
Dashboard
krait.zealynx.io/dashboard — all projects in one place. Scan findings, verification scores, shareable reports, activity timeline.
Detection Sources
Krait's detection layer combines original research with curated knowledge from the open-source security community. See ATTRIBUTION.md for details.
| Source | What We Integrated | License |
|---|
| pashov/skills | ~100 attack vectors across 8 modules + 58 extended heuristics | MIT |
| PlamenTSV/plamen | Devil's Advocate verification methodology | MIT |
| forefy/.context | Protocol-type context enrichment (10,600+ findings) | MIT |
Author
Carlos Vendrell Felici — Founder, Zealynx Security
Twitter/X · GitHub
License
MIT © Zealynx Security
