Quorum
Prove it, or drop it.
Quorum finds exploitable bugs in EVM contracts and publishes only the ones it can prove by running the exploit on a fork — and it publishes how often it is wrong on hacks it has never seen.
A finding is a claim until an exploit settles it. Quorum hunts with the strongest reader available (Pashov's twelve-agent solidity-auditor), scores every tool on a blind benchmark of hacks nobody tuned for, and then, for each candidate, has a model write a Foundry exploit on a fork at the block the bug was live. The scaffold measures the attacker's real balance change and publishes only what actually pays. Everything else is kept as a candidate, never asserted.
Point it at your own contract. The prove stage is not tied to the benchmark — give it a chain, a verified address, the block, and a one-line hypothesis and it settles the claim by execution: python prove/tool.py prove base 0x… --block 27000000 --function swapV3 --attack "free-mint moves the pool price". It answers PROVEN with the exploit that pays, or unproven with the reason it does not. Method: prove/PROVE.md.
Or let it hunt and prove in one shot. python prove/hunt.py base 0x… --block latest reads the verified source, proposes candidate bugs, and settles the top few on a fork — so it finds and proves without you writing the hypothesis. It dedupes and ranks the finder's output and proves only the top handful, which is the answer to reader noise: the prover, not a person, decides which candidates were real. Method: prove/PROVE.md.
This is a rebuild. Quorum began as the lens-swarm described below (a Sibyl Labs hackathon entry). Measuring it honestly showed the regex lenses are the weakest reader — 1 of 9 real 2026 hacks, 0 of 2 on a blind pair — so they were demoted to a cheap baseline and the engine was rebuilt around proof. The lens-swarm sections that follow are kept as the origin story and still carry their real measured numbers.
What it does today, measured:
- Four real 2026 hacks drained by a generated exploit, each reproducing to the wei with the model gone, no faked state: Unistreet (+0.0072 WETH), Sandbox (+1,000,000 SAND), Squid (+712 USDC), and — through the whole pipeline blind, on a hack the operator never read — GaslessReservoirEnabler (+0.836 WETH). Proofs:
prove/proofs/, method: prove/PROVE.md.
- A benchmark that cannot be tuned for. Only hacks reproduced after a freeze date count, scored before anyone reads the cause, order enforced in code:
bench/STREAM.md.
- The one number nobody else publishes: how often it is wrong, on hacks it has never seen. That is the whole differentiator — a trust moat, re-derivable by anyone.
Read the hacks, proven ↗ · The prove stage ↗ · The blind benchmark ↗
Telegram ↗ · Live site ↗ · Watch the demo ↗ · Verify it yourself ↗ · The paid claim ↗
Built for the Sibyl Labs Hackathon. Named one of fifteen consolation winners among 92 submissions when the results came out on 16 September 2026 (the announcement).
▶ Demo
The switch on runquorum.site, recorded live: flip the memory off and the same swarm on the same contracts confirms nothing.
Every terminal line in the demo is a real run: an empty memory, the lenses of that build on two teaching contracts, two findings published and five held back, three processes sharing one memory and doing twenty-four units of work once each, the reentrancy idiom recognised inside Friend.tech's live contract from a single sighting, the same swarm with memory removed confirming nothing, and the first claim on Base verified against memory. The video predates the fee: the paid claim on Robinhood Chain is on the registry page, not in the video.
quorum-demo-v2.mp4 (release asset, 12 MB) · the demo is also live: the deletion test switch on the front page and the in-browser claim verifier.
| Turn the memory off. It finds nothing. | Same files. Same checkers. One difference. | No burn. No memory. |
|---|
| | |
以上為 README 的開頭部分。其餘內容請閱讀原文。 檢視完整 README ↗
