Fetch Bytecode
Enter any contract or program address across EVM, Solana, or other supported runtimes. Automatically detects proxies and fetches implementation bytecode.
Paste a contract address; the pipeline fetches bytecode, lifts it through a three-tier IR, runs the detector suite, and emits a report you can ship.
Four steps from raw bytecode to a security report. Works directly from an address — no source code, no ABI, no compilation artifacts.
Enter any contract or program address across EVM, Solana, or other supported runtimes. Automatically detects proxies and fetches implementation bytecode.
Universal three-tier IR pipeline (LIR → MIR → HIR) transforms bytecode into higher-level languages with runtime-specific type inference and semantic analysis.
Automated vulnerability detectors run across the decompiled output. Optional fuzzing mode generates concrete inputs to validate findings against live contracts.
Vulnerability findings with severity ratings, code locations, and remediation guidance.
Every detector carries two independent accuracy records, and Sigvex never merges them. The first is how it scored against a labelled corpus — the same number for everyone. The second is what your own auditors concluded when they triaged its findings in your workspace. A detector that scores well on the corpus but that your team has never triaged is reported as exactly that, and one nobody has measured is labelled unmeasured rather than given a flattering default.
Findings carry that record inline, and the detector calibration panel lists it per detector: measured precision and recall, the number of labelled cases behind them, and your own confirmed and dismissed counts side by side. Where a value does not exist, you see a dash — never a zero standing in for a measurement nobody took.
The landing page has a pair of live contracts you can inspect without signing in, and /features breaks down the per-runtime capabilities.
View pricing