SaferICO combines expert human-led smart contract audits with continuous AI-powered monitoring, scanning and investigation — one platform covering the whole life of your protocol.
A deep, point-in-time review by security engineers who read every line, model the threats and prove each finding with a working exploit.
Continuous protection once the code is live: it watches, detects, investigates the alert with real tools and prepares the response for you to sign.
They are not tiers of the same thing. They solve different problems, at different moments, with different evidence.
Deep security review before launch.
→ You leave with a document you can hand to an exchange, an investor or a listing desk.
Continuous protection after launch.
→ You leave with a message the moment your protocol stops matching that document.
Audit before launch. · Monitor after launch.
Security is not a milestone you pass. It runs while you build, it gates the launch, and it keeps running long after — with one layer underneath that opens the moment anything stops adding up.
The scanner runs inside the pull request, in your own runner. A finding blocks the merge instead of surviving into production.
201 detectors · source never leaves your runnerA deep assessment on one frozen commit — and a working exploit proving every finding, so nothing lands as an opinion.
204 published · independently verifiableWatchtower re-reads the chain and the front end on a fixed schedule, and tells you the moment reality stops matching the report you paid for.
7 contract events · 1 wallet event · 6 site checksSAFI reads the alert, names the exploit path in the code that allows it, and hands back an unsigned transaction — your wallet still has to sign it.
19 tools · unsigned only · your keys never leave your walletStages 01 to 03 run on a clock. The layer underneath runs on an alarm.
A deep point-in-time assessment. It tells you exactly what the code did on one frozen commit, and proves it with a working exploit for every finding.
204 reports published · independently verifiableContinuous monitoring and security intelligence. It tells you the moment reality stops matching that baseline — and what the gap lets someone do.
7 contract events · 1 wallet event · 6 site checksYour audit establishes the security baseline. SAFI watches what happens after that baseline changes.
Not a drawer of disconnected tools. Five surfaces that hand work to each other, on one account and one meter.
Automated vulnerability detection over verified source and runtime bytecode.
201 detectors · 25 chainsAI security investigation and automation — it calls the tools, it does not describe them.
19 tools · unsigned onlyContinuous on-chain and front-end monitoring, on a fixed severity scale.
every 15 minutesSecurity checks inside the pull request, executed in your own runner.
source never leavesAdversarial testing for AI agents and wallet-connected systems.
20 probes · 6 stages201 detectors run across the verified source and the runtime bytecode, on 25 EVM mainnets. Every finding carries a rule id, a severity and the line it came from.
Free to try: 3 scans a day with no account, 10 a month once you sign in. A scan costs 5 credits on a paid plan.
SAFI reads the alert, pulls the contract, decodes the calldata, traces the funds and names the exploit path — then builds the transaction that fixes it and stops.
Every 15 minutes it re-reads the contract, the wallet and the page your users sign on — and tells you the moment any of them stops matching the baseline your audit established.
Certificate expiry is deliberately absent: a Cloudflare Worker cannot read the TLS chain, so it is not measured and not claimed.
The same 201 detectors, executed inside your own GitHub runner. Unreleased code never leaves your machine — only counts and rule ids come back.
Check failed — a new Critical crossed the budget. The source never left the runner.
20 adversarial probes across 6 stages, from prompt injection through to an attempted signature — driven against a decoy wallet that holds no private key.
A CLI, a local MCP server, a hosted MCP endpoint, a REST API with an OpenAPI description, a browser playground, and machine-readable discovery files. Whatever runs on your own CPU is free, because it costs us nothing to give away.
The full 201-detector audit as a terminal command. The engine is fetched once, verified against a published SHA-256, and run locally in a sandboxed VM context.
SARIF 2.1.0 · exit code is the gate · your source never leavesThe same package speaks MCP over stdio, so Claude Code or Cursor can run the real audit against files it already sees — without those files leaving the machine.
3 tools · the full engine, not a summary of itA remote MCP server carrying the six live read tools — prices, token facts, honeypot simulation, wallet balances, verification status, bytecode analysis — through your API key.
6 tools · same registry as the REST APITen operations under /api/v1, described by an OpenAPI 3.1.0 document generated from the tool registry the server executes. If it is in the spec, the server accepts it.
Every operation as a form built from openapi.json at page load, so it cannot drift from the API. Read the shapes for free; paste a key when you want to call something.
Three machine-readable files describing what an automated client can do here — and, as deliberately, what it cannot. All generated from the same registry.
no file can describe a tool that does not existThe hosted endpoints do not run the 201 detectors. That is a split, not a gap: the audit needs far more CPU than an edge request may use, and sending unreleased contracts to a third party to find out whether they are safe is a strange thing to ask. The engine runs in your browser, your CI runner, or your terminal.
Developer docs →Each one answers a question you have before you are ready to pay anybody: what is this transaction doing, is this agent config safe to install, and what is actually being caught out there.
What our own monitoring detected across every watched contract this week — ownership transfers, proxy upgrades, mint and pause events. Not a news wire. Our data.
Paste a hash and read what the transaction actually did, in a sentence. It is not an explorer — every link out of it points at one.
Read the skill file or MCP server config before you install it. 21 rules for what is dangerous by construction: a shell command in a server definition, a key committed into a config, an instruction telling the model to ignore its operator.
Five surfaces do the security work. Behind them sits everything else you already paid for — 31 realms across four wings, on one login, one credit meter and one severity scale.
This is what a manual review buys you: a function that compiles clean, reads clean, and does the opposite of what its name says.
An investor asked us to review FastBNB Yield before depositing more. The contract was verified on BscScan, the token maths was ordinary, and every automated pass came back clean. The manual review found an owner-only function labelled as adding liquidity — which in reality swept every depositor's BNB into the owner's private wallet. We traced each drain on-chain and published the proof.
// reads like it adds liquidity to the pool…function Liquidity() public onlyOwner { payable(owner).transfer( address(this).balance // ← every depositor );}
Every engagement moves through the same six-stage security pipeline, refined since 2021. No stage is optional, and nothing ships until every finding is verified fixed.
We map the architecture, define the threat model with your team, and freeze the exact commit — so everyone knows precisely what is under review.
▸ scope locked · commit hash frozenSlither, Mythril and our own detector suite sweep every code path for known vulnerability classes — reentrancy, access control, math, upgradeability.
▸ 201 detectors · every path sweptSenior auditors read the code line by line — business logic, economic attacks, privilege abuse and the bugs no scanner can see. This is where the critical findings live.
▸ line-by-line · logic & economicsEchidna, Medusa and Foundry invariant campaigns hammer the contracts with millions of randomized inputs to break assumptions humans never think to try.
▸ 1M+ randomized runs · invariants heldEvery finding gets a proof-of-concept exploit, a severity rating and a concrete fix. After your team patches, we re-test each one until it is verified closed.
▸ PoC per finding · fixes re-verifiedYou receive a severity-ranked report with PoCs, fixes and verification status — published on our GitHub so investors and users can verify it themselves.
▸ public report · independently verifiableEvery one of these protocols had been reviewed. The money still left — through something that changed afterwards, or through a surface the review never covered.
eIP-14 added donateToReserves eight months after review — the one balance-reducing path that skips the solvency check every other path runs.
A routine upgrade committed a root of 0x00…00 and marked it confirmed. Every unproven message became proven — then strangers copy-pasted the calldata.
The contract was never broken. A tampered JavaScript bundle reached the bucket serving the signing page. Three signers approved exactly what their screens showed them.
Written up in full, with external citations, in the Hall of Hacks — 20 incidents, $5.67B.
The latest reports from our public repository. Every one is published in full — the original PDF, downloadable and independently verifiable.
Every network below has a live RPC we verified and an explorer that hands back verified source. Manual audits are not limited to this list — Solidity carries across.
Building and deploying is priced on seven of these; a plan is paid on six. See the per-chain pages →
A monthly subscription buys you the platform. A human audit is a scoped engagement, priced per protocol. They are not tiers of one ladder, and this page will never sell them as if they were.
Everything you need to check a token
For devs & serious degens
For teams building & launching
The complete AI security suite
For a team with money already on-chain
No auto-renew — you decide each month · pay in ETH / BNB / POL on 6 networks · see full plan details →
Scope, timeline and price are set after we read the repository — because a 300-line token and a lending market are not the same job, and a fixed number in front of both would be a guess.
To be explicit: a $9.99, $29.90 or $59.90 subscription is not a professional security audit and is never sold as one. It buys automated scanning, monitoring and the SAFI agent. A human audit is a separate engagement with a scope, a team and a published report.
Everything teams ask before securing their contracts — timelines, chains, reports, and how to get started.
Get a direct answer from our security team — usually within a few hours.
Chat with us →A smart contract audit is a systematic examination of your contract's code to identify security vulnerabilities, bugs and logic errors before deployment. Since smart contracts handle real funds and are immutable once deployed, a professional audit can prevent catastrophic losses and protect your users.
Timelines depend entirely on the complexity, size and architecture of your protocol. After reviewing your codebase during the scoping phase, we provide a clear, tailored timeline alongside the engagement terms — so you know exactly what to expect before we begin.
Manual audits: any EVM-compatible chain — we have audited on 20+, including Ethereum, BNB Chain, Arbitrum, Base, Optimism, Polygon, Avalanche, zkSync, Linea, Scroll, Mantle and Blast. Since these chains all share Solidity, a review carries across them; the only real differences are things like precompiles and L2 sequencer behavior. Automated tools read 25 EVM networks — every one with a live RPC we verified and an explorer that hands back verified source. Building and deploying is priced on seven of those, and a plan is paid on six. Chain not listed? Contact us — we can almost certainly help.
An executive summary, detailed findings categorized by severity (Critical, High, Medium, Low, Informational), proof-of-concept for vulnerabilities, remediation recommendations and a post-fix verification. All reports are published publicly on our GitHub.
SaferICO is one of the few auditors officially verified and listed in the Etherscan Auditor Directory. Auditing since 2021, with 250+ completed audits and 1,000+ findings, we bring real depth of knowledge — and we are the only one that keeps watching the contract after the report is signed.
Your report becomes the security baseline. Watchtower then re-reads the contract, the wallet and your signing page every 15 minutes and alerts you the moment reality stops matching that baseline — an ownership transfer, a proxy upgrade, a liquidity move or a new script origin. CI Scan runs the same detectors on every commit, inside your own GitHub runner.
Pick a plan on the Plans page and pay from your own wallet — that wallet instantly becomes your account for 30 days. Logging in is a free signature (no gas, no email, no password). Scanning is free — 10 a month with an account, 3 a day without one — and the AI Agents plan ($59.9/mo) unlocks the full AI suite, including trading and automations. Manual audits are a separate engagement: contact us on Telegram. Nothing auto-renews.
Fill in the audit request form below or reach us directly on Telegram. Share your GitHub repository link, describe the scope, and we will respond within 24 hours with a timeline and a quote.
Preferred method — fastest response.
SaferICO Security Team
Average response: < 24 hours
Open Telegram →Fill in your project details and we will respond within 24 hours.
Start with a free scan, put SAFI on the contract, or send us the repository and get a scope and a timeline back within 24 hours.