Open folder
Select the project folder in the chat.
Workflows
security audit smart contract workflow
03
Review a token contract locally
Open the folder, read the code, run tests, and check the diff before accepting changes to your own files.
List files
List the contract files in the directory.
Read code
Read the main contract source code.
Run tests
Run the test command and
Findings log example
Review the token contract for reentrancy risks and access control issues.
- list_dir
.5 files - read_file
Token.solread - grep
external call3 matches - write_file
findings-log.txtsaved
waiting for your OK before the next stepRejectAccept
findings-log.txt
# Token Contract Review
Scope: ERC-20 token implementation
Test: local unit tests passed
Finding: Missing reentrancy guard
Severity: High
Location: transfer function
Fix: Add nonReentrant modifier
Status: Pending reviewA plain-text findings log showing the scope, test results, and a specific finding with severity and location for a token contract.
Learn smart contract auditing steps
Read and search code
The agent uses list_dir and glob to find all contract files in your working folder, and read_file opens the main source code for inspection. This is the start. Auditors find vulnerabilities in smart contracts by reading the code by hand. It runs grep to search for every external call, access check, and state change across the project. You see the search results immediately in the chat to verify every relevant line of code. Security failing once things went live is a major concern for any deployed protocol. This manual review step supports a structured security audit smart contract review before deployment. Learn smart contract auditing to understand the logic before the agent suggests any changes to the codebase.
Run tests and review
The agent uses Shell to run your test command and your static-check command on your PC, so it saves the output to a text file for reference and drafts findings. You can review these diffs. Reviewing these diffs helps you understand the entire audit process clearly. Getting started with solidity auditing involves reading the code by hand. The tool uses write_file to draft findings notes and proposed fixes. It shows you a diff before you accept any changes to your files. You can switch to Ask first mode to pause before every action that changes something. Passing tests confirm the fix resolves the issue, but a person still reviews the diff.
