Proovant reviews Solidity contracts and reports only what it can reproduce. Specialised AI agents analyse the code, a separate stage tries to disprove each suspicion, and what survives reaches you as an executable Foundry test.
For teams shipping Solidity who want a fast, evidence-backed second look, before an audit or after a change. Not a substitute for a full audit. Is it right for you?
test_exploit_reproduces()PASStest_control_normal_path_unaffected()PASSno passing test, left out of the findingsDROPPEDprotocol reviews completed, on live or pre-mainnet code.
findings written up across four of them, each with a runnable test.
local tests run behind the findings and the ideas ruled out.
review where nothing above Low survived. We said so.
Counts as of November 2026. Only Cloak has published its outcome, so the other teams are not named.
Finding CL-01 from our review of Cloak, a sealed-bid auction and shielded-pool protocol. The team fixed it and published the outcome.
In an oversubscribed NFT drop, a lottery decides the winners. A bidder could take far more than a fair share of the supply at the expense of honest bidders.
The lottery seed came only from the salts of the bids that were opened. A bidder holding several sealed bids could try every combination off-chain and open only the best one.
In our test (10 NFTs, 30 honest bids, an attacker with 8): a fair share is about 2.1 NFTs. The best of 256 combinations won 7.
$ forge test --match-path test/CloakPoc_Drop_CL01_CL03_CL04.t.sol -vv
[PASS] test_poc_tieGrind() (gas: 809676152)
fair expectation x1000 (8 tickets of 38, 10 NFTs): 2105
best NFTs won: 7
Suite result: ok. 3 passed; 0 failed; 0 skipped
Local chain, reviewed commit 27bffaa, no mocks needed for this test.
The team added the hash of the block after settlement to the draw. We retested the fix: over 60 fresh block hashes the best-looking combination won 95 NFTs, against 128 for opening every bid. A fair share is about 126. The advantage is gone.
Sealed-bid auctions and a shielded pool, reviewed before mainnet, with human review as on the Verified plan.
Read Cloak's published review log Read the redacted reportfindings reported, all reproduced in Foundry.
fixed by the team.
mitigated: the penalty for the attack was raised from 10% to 25%.
left as they were: by design, accepted, or testnet-only.
Outcomes are as published by the Cloak team. None of the findings let anyone take deposits or private balances.
Most leads do not survive, and that is the point. Read the full method and its limits.
Send the repository, commit and contracts in scope. Nothing starts until you accept the quote.
you send an emailWe read the scope, flag what we cannot cover, and reply with a quote and a time estimate.
scope and quoteEight specialist agents hunt in parallel, each on one family of bugs.
candidate leadsA separate agent tries to kill each lead. Survivors must reproduce in a Foundry test. On Verified, a researcher checks every finding.
confirmed findings onlyThe report and a drop-in test package arrive by email.
report + PoC packageSurvived the skeptic and has a passing test. Reported as a finding.
Plausible, but no test could be made to pass. Listed as a note, never rated Medium or above.
Unreachable, already fixed or documented, or no realistic impact. The reason is kept on file.
Both run the same pipeline and both require a passing test for every finding.
The full pipeline, no human review.
Price: quoted by repository sizeBest for: early code, pre-audit sweeps, checking a change.
Request a ScanThe same pipeline, checked by a researcher.
Price: quoted by scopeBest for: teams close to deployment, or who must show the report to auditors or investors.
Request VerifiedTurnaround is agreed in the quote. Verified takes longer because of the review. Neither plan is a formal audit or a guarantee. See what is and is not covered.
No. It is an AI-assisted security review. The Verified plan adds a human check, but neither plan replaces a full audit or guarantees your contracts are free of vulnerabilities.
A repository link, the commit you plan to deploy, the contracts in scope and your target date. Private repositories are fine: we arrange read-only access after you accept the quote. Never send tokens or passwords.
It is analysed on a private workstation and by Anthropic's Claude models, and deleted within 30 days of delivery. It is never published or shared. Full data handling.
You are told so, with what was covered and what was ruled out. One of our five reviews ended this way.
We reply by email with a scope and a quote. Nothing starts, and no code is cloned, before you accept.
Include in your email:
Never send tokens, passwords or private keys.