Catch what linters miss.
AI code review built for smart contract security. Understands cross-contract interactions, models economic attacks, and goes beyond pattern matching into semantic understanding.
Pattern matching, syntax rules
Semantic analysis, AI reasoning
1 pragma solidity ^0.8.19; 2 3 import "./IOracle.sol"; 4 import "./IFlashBorrower.sol"; 5 6 contract Vault { 7 mapping(address => uint256) public balances; 8 address public oracle; 9 address public owner; 10 11 function deposit() external payable { 12 balances[msg.sender] += msg.value; 13 } 14 15 function withdraw(uint256 amount) external { 16 require(balances[msg.sender] >= amount); 17 (bool success, ) = msg.sender.call{value: amount}(""); 18 require(success); 19 balances[msg.sender] -= amount; 20 } 21 22 function setOracle(address _oracle) external { 23 oracle = _oracle; 24 } 25 26 function getPrice() public view returns (uint256) { 27 return IOracle(oracle).latestPrice(); 28 } 29 30 function flashLoan(uint256 amount) external { 31 uint256 balBefore = address(this).balance; 32 IFlashBorrower(msg.sender).onFlashLoan(amount); 33 require(address(this).balance >= balBefore); 34 } 35 }
.call — use transfer
require
1 pragma solidity ^0.8.19; 2 3 import "./IOracle.sol"; 4 import "./IFlashBorrower.sol"; 5 6 contract Vault { 7 mapping(address => uint256) public balances; 8 address public oracle; 9 address public owner; 10 11 function deposit() external payable { 12 balances[msg.sender] += msg.value; 13 } 14 15 function withdraw(uint256 amount) external { 16 require(balances[msg.sender] >= amount); 17 (bool success, ) = msg.sender.call{value: amount}(""); 18 require(success); 19 balances[msg.sender] -= amount; 20 } 21 22 function setOracle(address _oracle) external { 23 oracle = _oracle; 24 } 25 26 function getPrice() public view returns (uint256) { 27 return IOracle(oracle).latestPrice(); 28 } 29 30 function flashLoan(uint256 amount) external { 31 uint256 balBefore = address(this).balance; 32 IFlashBorrower(msg.sender).onFlashLoan(amount); 33 require(address(this).balance >= balBefore); 34 } 35 }
Install the GitHub App. Review happens automatically on every PR.
One-click GitHub App installation. Select the repos you want monitored. No config files, no YAML, no pipeline changes.
Open a pull request like you normally would. DeepThreat Review triggers automatically on every PR and commit push.
9 analysis engines scan your changes. AI reasoning models cross-contract interactions, economic attack paths, and access control gaps that static tools miss.
Findings appear as inline PR comments with severity, explanation, and fix suggestions. Your team reviews and resolves them like any other code review comment.
Beyond syntax. Beyond patterns. Actual exploitable vulnerabilities.
Cross-function and cross-contract reentrancy, including read-only reentrancy through view functions.
Spot-price dependencies, TWAP window attacks, and stale oracle data that enables price manipulation.
Multi-step attack paths combining flash loans with other vulnerabilities for maximum extractable value.
Missing modifiers, privilege escalation paths, and unprotected admin functions.
Rounding errors in share calculations, precision loss in token conversions, and inflation attacks.
Unsafe external calls, composability issues, and cross-protocol interaction vulnerabilities.
DeepThreat Review is coming soon. Get notified when it launches.