SCORPIOEconomic Security Engine
Service live Try the preflight
Economic analysis for Solidity

Find the bug that moves the money.

Scorpio analyses public Solidity repositories, reconstructs how value moves and delivers reproducible evidence before the bug reaches a bug bounty or production.

Check a repository, free ↗ See the catalogue ↓
Preflight before payment x402 payment in USDC Verifiable delivery
ENGINE / LIVE CATALOGONLINE
STATE
VALUE
ACCESS
Scorpio mark
127MODULES
49STATIC CHECKS
FINGERPRINT890777…44a4
0Reachable modulesFingerprint of the deployed engine
0Economic familiesCoverage organised by risk
0Static sweepsPublished in the current catalogue
0Unreadable modulesCatalogue readable end to end
01 / METHOD

From a repository to evidence you can check.

Scorpio treats every analysis as a technical chain of custody. First it decides whether the repository is in scope, then it compiles, models and seals the result.

01
↳

Admission

It checks the public URL, the commit and the real size of the project's own code.

Free · no commitment
02
{ }

Compilation

It resolves the Foundry project and separates the project's own code from its dependencies.

Isolated environment
03
⌁

Economic map

It follows states, privileges and the routes value can travel along.

Cross-contract context
04
⌕

Sweeps

It runs the applicable families and ranks the signals by economic impact.

Deterministic engine
05
✓

Delivery

It writes the report with the findings ranked and returns it alongside the exact commit that was analysed.

Reproducible result
02 / BEFORE YOU PAY

Check whether your repository is in scope.

The preflight counts your own Solidity and your dependencies' before any payment is opened, and the real service does it: it clones the repository and reads its tree, without compiling it and without running anything from it. It is free, it is rate-limited, and a repository that is out of scope is rejected here instead of being charged for and failing later.

  • ✓ URL and commit identified
  • ✓ Own code separated from third-party code
  • ✓ Price fixed before you authorise the payment
SCORPIO / PREFLIGHTLIVE
git:
ProductFull audit · 149 USDC

Free, with nothing to pay. The service clones the repository and counts its Solidity by reading the tree, without compiling it or running anything from it. It takes a few seconds and it is rate-limited.

04 / MEASUREMENT

More signal per alert in the first shared benchmark.

Across five official CodeHawks cases, Scorpio matched 12 findings from the official list against Slither's 5, and raised 26 alerts in total against 63.

09SEPTEMBER
2026ENGINE 890777…
i

This is a small sample of five contests, not proof of general superiority. Scorpio's column was measured on 9 September 2026 with engine 890777033a8fc952…, over three identical repeat runs. The fingerprint of the deployed engine is shown at the top of this page: if it does not match, the measurement comes from an earlier engine and has not been repeated with today's. Slither's is from version 0.11.5 over the same frozen cases, measured on 6 September; Slither has not changed between the two dates.

!

What the 14 unmatched alerts actually are, because calling them “wrong” would be inaccurate: four are informational severity —three notices about a contract without events and one note on token assumptions—, context the engine delivers on purpose and that does not compete in a list of vulnerabilities; three say something true about the code, that the value returned by an ERC-20 transfer is not checked, which the contest did not accept as a finding; and one is a one-way switch the engine flags as a suspicion because whether that was intended is for a person to decide.

!

Of the remaining six, five are the same bug as an entry on the official list, under another name. The comparator pairs findings by requiring the detector to be named exactly like the label's family, so when the engine gets the bug right and names it by its cause instead of its effect, the score penalises it twice: the label is counted as missed and the finding as wrong. The five pairs have been checked one by one, on the same contract and, in four of them, the same function: the lock that never closes in refund is CH-05's reentrancy; the deadline that can be rewritten is CH-07; the unbounded loop over claimants is MC-08; the signature that does not bind the implementation is SP-01; and the digest without a typehash is SP-02. The sixth says something true that the list does not cover.

i

That adjudication is by hand and not impartial: it was done by the person who works on the engine. That is why the figures this page stands behind are still the mechanical ones. Counted with the five pairs accepted, it would be 17 matched and 9 unmatched, that is 65.4% precision and 35.4% coverage. It is stated so the difference can be seen, not so it can be claimed.

Scorpio52,6%
10 TP · 9 FP
SSlither7.9%
5 TP · 58 FP
48 official findings5 / 5 cases run15 / 15 stable runs
05 / HOW IT IS CHECKED

An engine that measures itself.

Every detector faces a contract written to make it fire and another, almost identical, written to make sure it does not. A change that breaks either one turns the bench red, and without a green bench the image that serves orders is not built.

0Bench contractsWritten to test the engine
0Planted defectsIt catches all 201
0Healthy controlsIt flags none of them
0% mutation scoreOver what can be killed
i

The mutation score changes one line of the engine on purpose and checks that the bench notices. Whatever the bench misses is written down one by one with the reason: why that line cannot change the result, or what case would be needed to make it. Today there are none left unread.

06 / COVERAGE

Ten families to follow economic risk.

Each family groups sweeps that look for one concrete way of breaking invariants, seizing privileges or diverting value.

01
±

Accounting

Balances, rounding, fees and conservation of value.

6 sweeps
02
⌁

Oracles

Prices, freshness, scales and manipulable dependencies.

4 sweeps
03
✎

Signatures

Replay, domains, nonces and cryptographic authorisations.

8 sweeps
04
⌾

Privileges

Roles, setters, initialisation and control escalation.

7 sweeps
05
↩

Reentrancy

External interactions and unsafe state changes.

4 sweeps
06
▦

Storage

Collisions, layout and corruption after upgrades.

4 sweeps
07
⇄

State machines

Impossible transitions, deadlocks and skipped phases.

6 sweeps
08
◫

Trapped funds

Exit routes that are missing or gated forever.

4 sweeps
09
0x

Encoding

Collisions, calldata and serialisation assumptions.

5 sweeps
10
※

Randomness

Predictable sources with an impact on economic outcomes.

1 sweep
07 / RESULT

A delivery that leaves a trail.

The report connects every signal to its place in the code, and travels with the exact commit it was produced against.

SCORPIO_REPORT
FINDING / ECONOMIC

Vulnerable value invariant

HIGHCONFIDENCE 0.86

report.md ✓
commit ✓
tree ✓
01

Ranked findings

Severity, confidence, location and expected economic effect.

02

Technical evidence

Code paths and enough context to reproduce the signal.

03

Provenance

The exact commit and tree of the clone that was analysed, returned alongside the report.

04

What was not measured

If a sweep did not finish, the order comes out marked INCOMPLETE and the report says so. Silence is never presented as “there is nothing here”.

08 / JUDGEMENT

What Scorpio claims.
And what it does not.

✓ It does deliver

  • Automated, repeatable analysis
  • Ranking by economic impact
  • Evidence tied to the code analysed
  • The exact commit and the report's seal
  • An explicit state for the run

× It does not promise

  • Zero false positives
  • Total coverage of vulnerabilities
  • Always finding a bug
  • Equivalence with a human audit
  • Automatic eligibility for bounties
09 / QUESTIONS

Before you launch an analysis.

The technical and commercial conditions that matter most, explained without small print.

Read the full terms ↗
Does Scorpio replace a human audit?

No. It narrows the search space and brings repeatable evidence, but it does not certify that the contract is safe, nor does it cover all the reasoning of a human review.

What can I analyse today?

Public repositories compatible with Foundry, accepted by the preflight and with at most 1,200 of your own Solidity files. The active product does not read on-chain state.

When are you charged?

First the free preflight runs. If the repository is in scope, Scorpio returns the exact offer. The analysis starts once the x402 payment is verified.

What happens if the engine fails?

The order ends in the FAILED state and the service price is refunded in accordance with the terms. Network fees outside Scorpio's control are not part of that refund.

How long does it take?

The catalogue estimates around five minutes of execution for the active product. It is a technical estimate, not an SLA: size, compilation and the queue can all change the total time.

What do DONE and INCOMPLETE mean?

DONE means the expected delivery finished. INCOMPLETE means a partial delivery exists, with its limits documented. PENDING and FAILED describe a run that is pending or failed. EXPIRED appears once the 30 days of retention have passed and the delivery has been deleted.

Can I submit a private repository?

Not with the current product. Do not send credentials, tokens or private URLs. The public offer is designed for repositories reachable without authentication.

How is the result verified?

Every order returns the exact commit and tree of the clone that was analysed, so any finding can be pointed at a concrete revision and looked at again. The engine version running at any moment is public at /health, with its content fingerprint.

SCORPIO / AUDIT-149

Before you trust value to it,
check the code.

The preflight is free and confirms the scope before any payment request is created.

Check a repository ↗