pay per scan
Smart contract scan
Scan a smart contract repository for 1 dollar and get, in a minute or two, the weak spots the model is most sure about, ready to check by hand. Every run and every miss is on a public scoreboard, and every delivered report goes on a dated list you can check yourself. It finds some of what a human audit finds, and we publish how much.
Watch it in a minute
In one minute: what our scan found, what it missed, and how you can check it. We publish every run on our fixed test sets, the misses included, together with the programs that check the results. Every number in this film can be checked from open files and on-chain records.
English, with English subtitles.
- Eight of a hundred and five.
- That is how many known findings version three point one of our scan found on eight audit contests. It missed ninety-seven.
- We publish both numbers.
- Every run goes on a public scoreboard within seven days. The bad ones too.
- The rule is written down and time-stamped before the first run it covers.
- Every report we deliver goes on a dated list. You check yours with one file.
- When money moves, you read it back from the chain. One real payment on Base. One rating, written by the buyer. One hash that ties them together.
- Everything we show, you can replay.
- Check. Pay. Prove. tokenizen.nl
What you get
A report of AI-generated hypotheses about the Solidity code in a public GitHub repository, to be reviewed by hand. The quick scan costs 1 dollar and returns the 15 hypotheses the model is most sure about, usually within a minute or two. The full scan costs 5 dollars, adds 15 less certain ones, and is usually done within the hour. You pay in USDC on Base over x402, so you need an x402 client and USDC: paying by card or invoice is not possible yet. Before you pay, a free check tells you how much of your code the scan will read: https://x402.tokenizen.nl/api/bug-intel/precheck?repo=owner/name
How you check it
Every run on our fixed sets goes on the public scoreboard within 7 days, the misses included, under a public rule with an OpenTimestamps stamp. Where a row links to a pre-registration, the rule was written down in public before the run; for version 3.1 the rule is only in our own notes, so that row is less verifiable. Version 3.1 found 8 of 105 known findings in its first 15 hypotheses, on the same eight contests as our sealed run, which were no longer secret by then, after two changes at once. In the sealed run the earlier versions found 1 and 4. Every report we deliver is also put on a public list: the fingerprint of the report, the outcome, the coverage and the time, without the repository or the buyer. The head of that list is stamped with OpenTimestamps, which is outside our control and counts as confirmed some hours after it is made. The list is at https://api.tokenizen.nl/api/scan-receipts and you check your own report with one file, verify-scan-receipts.mjs on this site. This shows that a report existed on that date and was not changed afterwards. It does not show which version of the code was scanned, and it does not show that the code is safe. Our own test runs are not on the list. Each square below is one known finding.
The programs that check our payment receipts and the list of delivered reports are open source, under the MIT and Apache-2.0 licences, so you can read them, run them and fork them. The scan's own prompts and model settings are not published.
Where it stops
It is not an audit and gives no guarantee that a contract is safe. What it finds and what it misses is on the public scoreboard.