Thragg-oti · OTI SEC LTD.

Audit smart contracts
like an attacker.

A 12-lens business-logic vulnerability sweep with mandatory four-gate validation — every finding survives an attack-execution, reachability, trigger, and impact check before it's ever shown to you.

12
Attack-surface lenses
4
Validation gates
$2.1B
Lost to exploits, 2024
67%
Were business-logic flaws

One tool, six lenses on your protocol

Everything in the audit dashboard, unlocked after you sign in

Live Audit Engine
Upload .sol/.move/.vy/.rs — get gate-validated findings with confidence scores, not generic pattern matches.
Probability Models
17 quantitative models — Markov, Bayesian, Kalman Filter, Hidden Markov Model — scoring exploit likelihood, not just presence.
Aave V2+V3 Checklist
38-item checklist covering E-Mode, isolation mode, variable close factor, and oracle sentinel.
Vulnerability Matrix
41 vulnerability classes cross-referenced against SWC, DASP, detection method, and real precedent from Immunefi bounties and 2,148 triaged Bounty Boost reports.
ChainLight Insights
2024 exploit postmortems — access control, oracle manipulation, reentrancy, bridge failures.
Risk Scoring
Bayesian-weighted risk score across 8 protocol dimensions, updated as findings accrue.

Five phases, every audit

1
Building context & architecture map
Parse contract structure, inheritance, and external dependencies.
2
Hunting business logic vulnerabilities
12-lens sweep — access control, economics, invariants, and cross-lens seams.
3
Extracting invariants & Foundry PoC
Derive conservation laws and state couplings the code must preserve.
4
Scoring code maturity
9-category maturity score across oracle safety, access control, and arithmetic.
5
Synthesizing & deduplicating findings
Four-gate validation — execution, reachability, trigger, impact — before anything ships.