Smart Contract Auditor

Source-level security review of Solidity: pass/warn/fail verdict, 0-100 risk score, severity-ranked findings with exact file:line, exploit scenario and a fix, plus a SARIF 2.1.0 log. Accepts raw code, a list of files, or an on-chain address (verified source is read from Sourcify). A deterministic detector pass (reentrancy ordering, tx.origin, delegatecall, unchecked calls, weak randomness, pre-0.8 arithmetic) runs beside one model review, and every model finding is checked against the source: its quoted snippet must exist and its line is corrected. A pre-audit triage, not a substitute for a manual audit; it cannot see deployed bytecode, off-chain components or economic assumptions, and not_checked lists what was missing.

Every result is a signed, verifiable answer:

• a W3C Verifiable Credential 2.0, signed with eddsa-jcs-2022 by did:web:agents.writerslogic.com;
• a C2PA-style manifest that lists every source the agent read, each with its SHA-256;
• an EIP-191 co-signature over the same digest.

Change one byte and verification fails, so you can pass the result to a client, an auditor or another agent and they can check it without trusting you or us.

How to use Smart Contract Auditor

1. Fill in the input form. Required fields are marked; the form opens with a working example.
2. Start the run.
3. Read the result in the Output tab, or download the dataset as JSON. The full signed envelope is also saved as the OUTPUT record in the key-value store.

Input

Field	Required	Description
code	no	Raw Solidity source (one or more files concatenated). Provide exactly one of code, files or address.
contractName	no	Contract to focus on when several are present.
files	no	Alternative to code: Solidity files with repository-relative paths. Findings report the file and line, and the SARIF log points at them.
address	no	Alternative to code: an on-chain contract address. Its verified source is read from Sourcify (no API key); unverified contracts return 404.
chainId	no	EVM chain id for address; default 1 (Ethereum mainnet).

Example input:

{
  "code": "pragma solidity ^0.8.20;\ncontract Vault {\n  mapping(address => uint256) public balances;\n  function deposit() external payable { balances[msg.sender] += msg.value; }\n  function withdraw() external {\n    (bool ok, ) = msg.sender.call{value: balances[msg.sender]}(\"\");\n    require(ok);\n    balances[msg.sender] = 0;\n  }\n}",
  "contractName": "Vault"
}

Output

{
  "agent": "contract-auditor",
  "priceUsd": 1.25,
  "data": { "...": "the agent's answer" },
  "_provenance": { "credential": {}, "manifest": {}, "ethSignature": "0x..." }
}

To check a result for free, POST { "data": ..., "_provenance": ... } to https://agents.writerslogic.com/api/v1/verify-provenance, or verify it offline against the public key in the DID document.

Pricing

$1.25 per successful run, charged once and only after the agent returns its answer. If the input is rejected or the agent fails, you are not charged for the call.

Use it from code or an AI assistant

• Apify API and integrations: call this Actor from Make, Zapier, n8n, LangChain or the Apify API like any other Actor.
• MCP: npx -y @writerslogic/ai-agents-mcp exposes this agent and the rest of the hub as tools.
• x402: the same agent is available at POST https://agents.writerslogic.com/api/v1/audit-contract, paid per call in USDC on Base.

More verifiable agents

• On-Chain Bytecode & Unverified Token Trap Detector
• PR / Dependency Breaking-Change & Exploit Gatekeeper
• Legal citation and quotation verifier (US case law)
• Grant Milestone Verifier with Signed Release Attestation
• DeFi Cover Claim Adjudicator
• Vault Exit Lawyer
• All agents in one Actor

FAQ

Who runs this? WritersLogic. The agent runs on the WritersLogic Verifiable AI Agent Hub; this Actor sends your input there and returns the signed result.

Is my input stored? The Actor stores your result in your own Apify storage. Ask before sending confidential documents; the hub is a third-party service from your point of view.