chainaudit 1.0.1__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. chainaudit-1.0.1/PKG-INFO +194 -0
  2. chainaudit-1.0.1/README.md +159 -0
  3. chainaudit-1.0.1/chainaudit.egg-info/PKG-INFO +194 -0
  4. chainaudit-1.0.1/chainaudit.egg-info/SOURCES.txt +20 -0
  5. chainaudit-1.0.1/chainaudit.egg-info/dependency_links.txt +1 -0
  6. chainaudit-1.0.1/chainaudit.egg-info/entry_points.txt +2 -0
  7. chainaudit-1.0.1/chainaudit.egg-info/requires.txt +5 -0
  8. chainaudit-1.0.1/chainaudit.egg-info/top_level.txt +2 -0
  9. chainaudit-1.0.1/chainaudit_entry.py +11 -0
  10. chainaudit-1.0.1/ml/predictor.py +59 -0
  11. chainaudit-1.0.1/ml/train.py +225 -0
  12. chainaudit-1.0.1/pyproject.toml +3 -0
  13. chainaudit-1.0.1/setup.cfg +4 -0
  14. chainaudit-1.0.1/setup.py +42 -0
  15. chainaudit-1.0.1/src/__init__.py +0 -0
  16. chainaudit-1.0.1/src/cli.py +484 -0
  17. chainaudit-1.0.1/src/exploit_simulator.py +24 -0
  18. chainaudit-1.0.1/src/main.py +71 -0
  19. chainaudit-1.0.1/src/report_gen.py +45 -0
  20. chainaudit-1.0.1/src/rules.py +692 -0
  21. chainaudit-1.0.1/src/scanner.py +145 -0
  22. chainaudit-1.0.1/tests/test_cli.py +575 -0
chainaudit-1.0.1/PKG-INFO ADDED
@@ -0,0 +1,194 @@
1
+ Metadata-Version: 2.4
2
+ Name: chainaudit
3
+ Version: 1.0.1
4
+ Summary: Smart contract security scanner — Slither + ML exploitability prediction
5
+ Home-page: https://github.com/aizen299/smart-contract-auditor
6
+ Author: Aditya Raina
7
+ Author-email: rainaaditya58@gmail.com
8
+ License: MIT
9
+ Project-URL: Live, https://chainaudit.vercel.app
10
+ Project-URL: Source, https://github.com/aizen299/smart-contract-auditor
11
+ Keywords: solidity smart-contract security audit slither ethereum arbitrum optimism
12
+ Classifier: Programming Language :: Python :: 3.11
13
+ Classifier: Operating System :: OS Independent
14
+ Classifier: Topic :: Security
15
+ Classifier: Topic :: Software Development :: Quality Assurance
16
+ Requires-Python: >=3.11
17
+ Description-Content-Type: text/markdown
18
+ Requires-Dist: rich
19
+ Requires-Dist: scikit-learn==1.4.0
20
+ Requires-Dist: pandas==2.2.0
21
+ Requires-Dist: numpy==1.26.4
22
+ Requires-Dist: joblib==1.3.2
23
+ Dynamic: author
24
+ Dynamic: author-email
25
+ Dynamic: classifier
26
+ Dynamic: description
27
+ Dynamic: description-content-type
28
+ Dynamic: home-page
29
+ Dynamic: keywords
30
+ Dynamic: license
31
+ Dynamic: project-url
32
+ Dynamic: requires-dist
33
+ Dynamic: requires-python
34
+ Dynamic: summary
35
+
36
+ # ChainAudit
37
+
38
+ Production-grade smart contract security scanner. Upload a Solidity file or zip, get a real-time audit report with risk scores, ML exploitability predictions, and L2/Arbitrum/Optimism-aware findings.
39
+
40
+
41
+ ---
42
+
43
+ ## Stack
44
+
45
+ | | |
46
+ |---|---|
47
+ | Frontend | Next.js 14, TypeScript, Tailwind CSS |
48
+ | Backend | FastAPI, Python 3.11 |
49
+ | Analysis | Slither, solc-select, CVSS-inspired scoring |
50
+ | ML | Random Forest — 88% accuracy (SmartBugs dataset) |
51
+ | Auth | Supabase — email, GitHub, Google OAuth |
52
+ | Deploy | Vercel + Render |
53
+ | CI/CD | GitHub Actions + GitHub Marketplace Action |
54
+
55
+ ---
56
+
57
+ ## GitHub Action
58
+
59
+ Use ChainAudit in any CI pipeline:
60
+
61
+ ```yaml
62
+ - uses: aizen299/smart-contract-auditor@v1
63
+ with:
64
+ target: contracts/
65
+ fail-on-critical: true
66
+ ```
67
+
68
+ Outputs: `risk-score`, `total-findings`, `critical-count`, `high-count`, `report-path`
69
+
70
+ ---
71
+
72
+ ## CLI
73
+
74
+ ```bash
75
+ cd backend && pip install -e .
76
+
77
+ chainaudit scan contract.sol # single file
78
+ chainaudit scan ./contracts --recursive # directory
79
+ chainaudit scan contracts.zip # zip archive
80
+ chainaudit scan contract.sol --json # JSON output
81
+ chainaudit scan contract.sol --ml-only # skip simulation
82
+ ```
83
+
84
+ Exit code `1` on CRITICAL findings — blocks deployments in CI.
85
+
86
+ ---
87
+
88
+ ## Local Development
89
+
90
+ ```bash
91
+ # Backend
92
+ cd backend
93
+ python -m venv .venv && source .venv/bin/activate
94
+ pip install -r requirements.txt
95
+ uvicorn api:app --reload
96
+
97
+ # Frontend
98
+ cd frontend
99
+ npm install && npm run dev
100
+ ```
101
+
102
+ **`frontend/.env.local`**
103
+ ```
104
+ NEXT_PUBLIC_SUPABASE_URL=your_supabase_url
105
+ NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key
106
+ NEXT_PUBLIC_API_URL=http://localhost:8000
107
+ ```
108
+
109
+ **Docker**
110
+ ```bash
111
+ cp docker-compose.example.yml docker-compose.yml
112
+ docker compose up --build
113
+ ```
114
+
115
+ ---
116
+
117
+ ## API
118
+
119
+ `POST /scan` — single `.sol` file
120
+ `POST /scan/zip` — multiple contracts (max 20 files, 5MB)
121
+
122
+ ```json
123
+ {
124
+ "risk_score": 86,
125
+ "total_findings": 6,
126
+ "findings": [
127
+ {
128
+ "title": "Reentrancy",
129
+ "severity": "CRITICAL",
130
+ "ml_exploitability": "CRITICAL",
131
+ "ml_confidence": 0.96,
132
+ "occurrences": 7,
133
+ "chain": "arbitrum",
134
+ "l2_detected": true
135
+ }
136
+ ]
137
+ }
138
+ ```
139
+
140
+ ---
141
+
142
+ ## Vulnerability Coverage
143
+
144
+ **EVM (all chains) — 16 rules**
145
+
146
+ | Severity | Rules |
147
+ |----------|-------|
148
+ | CRITICAL | Reentrancy, Reentrancy with Unlimited Gas, Controlled Delegatecall |
149
+ | HIGH | Unchecked Token Transfer, Arbitrary ETH Send, Weak Randomness, tx.origin Auth, Selfdestruct Risk, Access Control, Unchecked Low-level Call |
150
+ | MEDIUM | Timestamp Dependence, Unchecked Send, Deprecated Standards |
151
+ | LOW | Missing Zero Check, Incorrect Equality, Missing Events, Naming Convention |
152
+
153
+ **L2 / Arbitrum / Optimism — 12 rules**
154
+
155
+ | Severity | Rules |
156
+ |----------|-------|
157
+ | CRITICAL | Cross-Chain Replay Attack, Bridge Reentrancy, Proxy Storage Collision, msg.value Misuse |
158
+ | HIGH | L2 Block Number Assumption, L2 Timestamp Assumption, Sequencer Dependence, Address Aliasing, Unvalidated Bridge Sender |
159
+ | MEDIUM | Force-Include Griefing, Gas Price Assumption, Optimism Deposit Griefing |
160
+
161
+ L2 rules are **auto-detected** — the scanner reads contract source for Arbitrum/Optimism identifiers (`ArbSys`, `xDomainMessageSender`, `IL2Bridge` etc.) and injects chain-specific findings automatically.
162
+
163
+ ---
164
+
165
+ ## ML Pipeline
166
+
167
+ Trained on SmartBugs dataset (143 contracts, 10 vulnerability classes). Random Forest classifier predicts exploitability per finding with a confidence score. 88% accuracy overall — 95% precision on HIGH, 93% on CRITICAL.
168
+
169
+ ---
170
+
171
+ ## Deployment
172
+
173
+ | | Platform | URL |
174
+ |--|---------|-----|
175
+ | Frontend | Vercel | chainaudit.vercel.app |
176
+ | Backend | Render | smart-contract-auditor-812q.onrender.com |
177
+ | Uptime | UptimeRobot | `/health` pinged every 5 min |
178
+
179
+ ---
180
+
181
+ ## Roadmap
182
+
183
+ - [x] 16 EVM vulnerability rules + CVSS scoring
184
+ - [x] 12 L2/Arbitrum/Optimism rules with auto-detection
185
+ - [x] ML exploitability prediction
186
+ - [x] Multi-contract zip scanning
187
+ - [x] Supabase auth + scan history
188
+ - [x] CLI tool — `chainaudit scan`
189
+ - [x] GitHub Marketplace Action
190
+ - [x] Docker, Vercel + Render, CI/CD
191
+ - [ ] Solana / Rust support
192
+ - [ ] PyPI — `pip install chainaudit`
193
+ - [ ] Monetize — free/pro tiers, Stripe billing
194
+ - [ ] API keys for enterprise
chainaudit-1.0.1/README.md ADDED
@@ -0,0 +1,159 @@
1
+ # ChainAudit
2
+
3
+ Production-grade smart contract security scanner. Upload a Solidity file or zip, get a real-time audit report with risk scores, ML exploitability predictions, and L2/Arbitrum/Optimism-aware findings.
4
+
5
+
6
+ ---
7
+
8
+ ## Stack
9
+
10
+ | | |
11
+ |---|---|
12
+ | Frontend | Next.js 14, TypeScript, Tailwind CSS |
13
+ | Backend | FastAPI, Python 3.11 |
14
+ | Analysis | Slither, solc-select, CVSS-inspired scoring |
15
+ | ML | Random Forest — 88% accuracy (SmartBugs dataset) |
16
+ | Auth | Supabase — email, GitHub, Google OAuth |
17
+ | Deploy | Vercel + Render |
18
+ | CI/CD | GitHub Actions + GitHub Marketplace Action |
19
+
20
+ ---
21
+
22
+ ## GitHub Action
23
+
24
+ Use ChainAudit in any CI pipeline:
25
+
26
+ ```yaml
27
+ - uses: aizen299/smart-contract-auditor@v1
28
+ with:
29
+ target: contracts/
30
+ fail-on-critical: true
31
+ ```
32
+
33
+ Outputs: `risk-score`, `total-findings`, `critical-count`, `high-count`, `report-path`
34
+
35
+ ---
36
+
37
+ ## CLI
38
+
39
+ ```bash
40
+ cd backend && pip install -e .
41
+
42
+ chainaudit scan contract.sol # single file
43
+ chainaudit scan ./contracts --recursive # directory
44
+ chainaudit scan contracts.zip # zip archive
45
+ chainaudit scan contract.sol --json # JSON output
46
+ chainaudit scan contract.sol --ml-only # skip simulation
47
+ ```
48
+
49
+ Exit code `1` on CRITICAL findings — blocks deployments in CI.
50
+
51
+ ---
52
+
53
+ ## Local Development
54
+
55
+ ```bash
56
+ # Backend
57
+ cd backend
58
+ python -m venv .venv && source .venv/bin/activate
59
+ pip install -r requirements.txt
60
+ uvicorn api:app --reload
61
+
62
+ # Frontend
63
+ cd frontend
64
+ npm install && npm run dev
65
+ ```
66
+
67
+ **`frontend/.env.local`**
68
+ ```
69
+ NEXT_PUBLIC_SUPABASE_URL=your_supabase_url
70
+ NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key
71
+ NEXT_PUBLIC_API_URL=http://localhost:8000
72
+ ```
73
+
74
+ **Docker**
75
+ ```bash
76
+ cp docker-compose.example.yml docker-compose.yml
77
+ docker compose up --build
78
+ ```
79
+
80
+ ---
81
+
82
+ ## API
83
+
84
+ `POST /scan` — single `.sol` file
85
+ `POST /scan/zip` — multiple contracts (max 20 files, 5MB)
86
+
87
+ ```json
88
+ {
89
+ "risk_score": 86,
90
+ "total_findings": 6,
91
+ "findings": [
92
+ {
93
+ "title": "Reentrancy",
94
+ "severity": "CRITICAL",
95
+ "ml_exploitability": "CRITICAL",
96
+ "ml_confidence": 0.96,
97
+ "occurrences": 7,
98
+ "chain": "arbitrum",
99
+ "l2_detected": true
100
+ }
101
+ ]
102
+ }
103
+ ```
104
+
105
+ ---
106
+
107
+ ## Vulnerability Coverage
108
+
109
+ **EVM (all chains) — 16 rules**
110
+
111
+ | Severity | Rules |
112
+ |----------|-------|
113
+ | CRITICAL | Reentrancy, Reentrancy with Unlimited Gas, Controlled Delegatecall |
114
+ | HIGH | Unchecked Token Transfer, Arbitrary ETH Send, Weak Randomness, tx.origin Auth, Selfdestruct Risk, Access Control, Unchecked Low-level Call |
115
+ | MEDIUM | Timestamp Dependence, Unchecked Send, Deprecated Standards |
116
+ | LOW | Missing Zero Check, Incorrect Equality, Missing Events, Naming Convention |
117
+
118
+ **L2 / Arbitrum / Optimism — 12 rules**
119
+
120
+ | Severity | Rules |
121
+ |----------|-------|
122
+ | CRITICAL | Cross-Chain Replay Attack, Bridge Reentrancy, Proxy Storage Collision, msg.value Misuse |
123
+ | HIGH | L2 Block Number Assumption, L2 Timestamp Assumption, Sequencer Dependence, Address Aliasing, Unvalidated Bridge Sender |
124
+ | MEDIUM | Force-Include Griefing, Gas Price Assumption, Optimism Deposit Griefing |
125
+
126
+ L2 rules are **auto-detected** — the scanner reads contract source for Arbitrum/Optimism identifiers (`ArbSys`, `xDomainMessageSender`, `IL2Bridge` etc.) and injects chain-specific findings automatically.
127
+
128
+ ---
129
+
130
+ ## ML Pipeline
131
+
132
+ Trained on SmartBugs dataset (143 contracts, 10 vulnerability classes). Random Forest classifier predicts exploitability per finding with a confidence score. 88% accuracy overall — 95% precision on HIGH, 93% on CRITICAL.
133
+
134
+ ---
135
+
136
+ ## Deployment
137
+
138
+ | | Platform | URL |
139
+ |--|---------|-----|
140
+ | Frontend | Vercel | chainaudit.vercel.app |
141
+ | Backend | Render | smart-contract-auditor-812q.onrender.com |
142
+ | Uptime | UptimeRobot | `/health` pinged every 5 min |
143
+
144
+ ---
145
+
146
+ ## Roadmap
147
+
148
+ - [x] 16 EVM vulnerability rules + CVSS scoring
149
+ - [x] 12 L2/Arbitrum/Optimism rules with auto-detection
150
+ - [x] ML exploitability prediction
151
+ - [x] Multi-contract zip scanning
152
+ - [x] Supabase auth + scan history
153
+ - [x] CLI tool — `chainaudit scan`
154
+ - [x] GitHub Marketplace Action
155
+ - [x] Docker, Vercel + Render, CI/CD
156
+ - [ ] Solana / Rust support
157
+ - [ ] PyPI — `pip install chainaudit`
158
+ - [ ] Monetize — free/pro tiers, Stripe billing
159
+ - [ ] API keys for enterprise
chainaudit-1.0.1/chainaudit.egg-info/PKG-INFO ADDED
@@ -0,0 +1,194 @@
1
+ Metadata-Version: 2.4
2
+ Name: chainaudit
3
+ Version: 1.0.1
4
+ Summary: Smart contract security scanner — Slither + ML exploitability prediction
5
+ Home-page: https://github.com/aizen299/smart-contract-auditor
6
+ Author: Aditya Raina
7
+ Author-email: rainaaditya58@gmail.com
8
+ License: MIT
9
+ Project-URL: Live, https://chainaudit.vercel.app
10
+ Project-URL: Source, https://github.com/aizen299/smart-contract-auditor
11
+ Keywords: solidity smart-contract security audit slither ethereum arbitrum optimism
12
+ Classifier: Programming Language :: Python :: 3.11
13
+ Classifier: Operating System :: OS Independent
14
+ Classifier: Topic :: Security
15
+ Classifier: Topic :: Software Development :: Quality Assurance
16
+ Requires-Python: >=3.11
17
+ Description-Content-Type: text/markdown
18
+ Requires-Dist: rich
19
+ Requires-Dist: scikit-learn==1.4.0
20
+ Requires-Dist: pandas==2.2.0
21
+ Requires-Dist: numpy==1.26.4
22
+ Requires-Dist: joblib==1.3.2
23
+ Dynamic: author
24
+ Dynamic: author-email
25
+ Dynamic: classifier
26
+ Dynamic: description
27
+ Dynamic: description-content-type
28
+ Dynamic: home-page
29
+ Dynamic: keywords
30
+ Dynamic: license
31
+ Dynamic: project-url
32
+ Dynamic: requires-dist
33
+ Dynamic: requires-python
34
+ Dynamic: summary
35
+
36
+ # ChainAudit
37
+
38
+ Production-grade smart contract security scanner. Upload a Solidity file or zip, get a real-time audit report with risk scores, ML exploitability predictions, and L2/Arbitrum/Optimism-aware findings.
39
+
40
+
41
+ ---
42
+
43
+ ## Stack
44
+
45
+ | | |
46
+ |---|---|
47
+ | Frontend | Next.js 14, TypeScript, Tailwind CSS |
48
+ | Backend | FastAPI, Python 3.11 |
49
+ | Analysis | Slither, solc-select, CVSS-inspired scoring |
50
+ | ML | Random Forest — 88% accuracy (SmartBugs dataset) |
51
+ | Auth | Supabase — email, GitHub, Google OAuth |
52
+ | Deploy | Vercel + Render |
53
+ | CI/CD | GitHub Actions + GitHub Marketplace Action |
54
+
55
+ ---
56
+
57
+ ## GitHub Action
58
+
59
+ Use ChainAudit in any CI pipeline:
60
+
61
+ ```yaml
62
+ - uses: aizen299/smart-contract-auditor@v1
63
+ with:
64
+ target: contracts/
65
+ fail-on-critical: true
66
+ ```
67
+
68
+ Outputs: `risk-score`, `total-findings`, `critical-count`, `high-count`, `report-path`
69
+
70
+ ---
71
+
72
+ ## CLI
73
+
74
+ ```bash
75
+ cd backend && pip install -e .
76
+
77
+ chainaudit scan contract.sol # single file
78
+ chainaudit scan ./contracts --recursive # directory
79
+ chainaudit scan contracts.zip # zip archive
80
+ chainaudit scan contract.sol --json # JSON output
81
+ chainaudit scan contract.sol --ml-only # skip simulation
82
+ ```
83
+
84
+ Exit code `1` on CRITICAL findings — blocks deployments in CI.
85
+
86
+ ---
87
+
88
+ ## Local Development
89
+
90
+ ```bash
91
+ # Backend
92
+ cd backend
93
+ python -m venv .venv && source .venv/bin/activate
94
+ pip install -r requirements.txt
95
+ uvicorn api:app --reload
96
+
97
+ # Frontend
98
+ cd frontend
99
+ npm install && npm run dev
100
+ ```
101
+
102
+ **`frontend/.env.local`**
103
+ ```
104
+ NEXT_PUBLIC_SUPABASE_URL=your_supabase_url
105
+ NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key
106
+ NEXT_PUBLIC_API_URL=http://localhost:8000
107
+ ```
108
+
109
+ **Docker**
110
+ ```bash
111
+ cp docker-compose.example.yml docker-compose.yml
112
+ docker compose up --build
113
+ ```
114
+
115
+ ---
116
+
117
+ ## API
118
+
119
+ `POST /scan` — single `.sol` file
120
+ `POST /scan/zip` — multiple contracts (max 20 files, 5MB)
121
+
122
+ ```json
123
+ {
124
+ "risk_score": 86,
125
+ "total_findings": 6,
126
+ "findings": [
127
+ {
128
+ "title": "Reentrancy",
129
+ "severity": "CRITICAL",
130
+ "ml_exploitability": "CRITICAL",
131
+ "ml_confidence": 0.96,
132
+ "occurrences": 7,
133
+ "chain": "arbitrum",
134
+ "l2_detected": true
135
+ }
136
+ ]
137
+ }
138
+ ```
139
+
140
+ ---
141
+
142
+ ## Vulnerability Coverage
143
+
144
+ **EVM (all chains) — 16 rules**
145
+
146
+ | Severity | Rules |
147
+ |----------|-------|
148
+ | CRITICAL | Reentrancy, Reentrancy with Unlimited Gas, Controlled Delegatecall |
149
+ | HIGH | Unchecked Token Transfer, Arbitrary ETH Send, Weak Randomness, tx.origin Auth, Selfdestruct Risk, Access Control, Unchecked Low-level Call |
150
+ | MEDIUM | Timestamp Dependence, Unchecked Send, Deprecated Standards |
151
+ | LOW | Missing Zero Check, Incorrect Equality, Missing Events, Naming Convention |
152
+
153
+ **L2 / Arbitrum / Optimism — 12 rules**
154
+
155
+ | Severity | Rules |
156
+ |----------|-------|
157
+ | CRITICAL | Cross-Chain Replay Attack, Bridge Reentrancy, Proxy Storage Collision, msg.value Misuse |
158
+ | HIGH | L2 Block Number Assumption, L2 Timestamp Assumption, Sequencer Dependence, Address Aliasing, Unvalidated Bridge Sender |
159
+ | MEDIUM | Force-Include Griefing, Gas Price Assumption, Optimism Deposit Griefing |
160
+
161
+ L2 rules are **auto-detected** — the scanner reads contract source for Arbitrum/Optimism identifiers (`ArbSys`, `xDomainMessageSender`, `IL2Bridge` etc.) and injects chain-specific findings automatically.
162
+
163
+ ---
164
+
165
+ ## ML Pipeline
166
+
167
+ Trained on SmartBugs dataset (143 contracts, 10 vulnerability classes). Random Forest classifier predicts exploitability per finding with a confidence score. 88% accuracy overall — 95% precision on HIGH, 93% on CRITICAL.
168
+
169
+ ---
170
+
171
+ ## Deployment
172
+
173
+ | | Platform | URL |
174
+ |--|---------|-----|
175
+ | Frontend | Vercel | chainaudit.vercel.app |
176
+ | Backend | Render | smart-contract-auditor-812q.onrender.com |
177
+ | Uptime | UptimeRobot | `/health` pinged every 5 min |
178
+
179
+ ---
180
+
181
+ ## Roadmap
182
+
183
+ - [x] 16 EVM vulnerability rules + CVSS scoring
184
+ - [x] 12 L2/Arbitrum/Optimism rules with auto-detection
185
+ - [x] ML exploitability prediction
186
+ - [x] Multi-contract zip scanning
187
+ - [x] Supabase auth + scan history
188
+ - [x] CLI tool — `chainaudit scan`
189
+ - [x] GitHub Marketplace Action
190
+ - [x] Docker, Vercel + Render, CI/CD
191
+ - [ ] Solana / Rust support
192
+ - [ ] PyPI — `pip install chainaudit`
193
+ - [ ] Monetize — free/pro tiers, Stripe billing
194
+ - [ ] API keys for enterprise
chainaudit-1.0.1/chainaudit.egg-info/SOURCES.txt ADDED
@@ -0,0 +1,20 @@
1
+ README.md
2
+ chainaudit_entry.py
3
+ pyproject.toml
4
+ setup.py
5
+ chainaudit.egg-info/PKG-INFO
6
+ chainaudit.egg-info/SOURCES.txt
7
+ chainaudit.egg-info/dependency_links.txt
8
+ chainaudit.egg-info/entry_points.txt
9
+ chainaudit.egg-info/requires.txt
10
+ chainaudit.egg-info/top_level.txt
11
+ ml/predictor.py
12
+ ml/train.py
13
+ src/__init__.py
14
+ src/cli.py
15
+ src/exploit_simulator.py
16
+ src/main.py
17
+ src/report_gen.py
18
+ src/rules.py
19
+ src/scanner.py
20
+ tests/test_cli.py
chainaudit-1.0.1/chainaudit.egg-info/entry_points.txt ADDED
@@ -0,0 +1,2 @@
1
+ [console_scripts]
2
+ chainaudit = chainaudit_entry:main
chainaudit-1.0.1/chainaudit.egg-info/requires.txt ADDED
@@ -0,0 +1,5 @@
1
+ rich
2
+ scikit-learn==1.4.0
3
+ pandas==2.2.0
4
+ numpy==1.26.4
5
+ joblib==1.3.2
chainaudit-1.0.1/chainaudit.egg-info/top_level.txt ADDED
@@ -0,0 +1,2 @@
1
+ chainaudit_entry
2
+ src
chainaudit-1.0.1/chainaudit_entry.py ADDED
@@ -0,0 +1,11 @@
1
+ import sys
2
+ from pathlib import Path
3
+
4
+ # Always resolves to the backend/ directory where this file lives
5
+ # Works for any user on any machine
6
+ sys.path.insert(0, str(Path(__file__).resolve().parent))
7
+
8
+ from src.cli import main
9
+
10
+ if __name__ == "__main__":
11
+ main()
chainaudit-1.0.1/ml/predictor.py ADDED
@@ -0,0 +1,59 @@
1
+ # backend/ml/predictor.py
2
+ import re
3
+ from pathlib import Path
4
+ import joblib
5
+ import pandas as pd
6
+ import numpy as np
7
+
8
+ MODEL_PATH = Path(__file__).resolve().parent / "exploitability_model.joblib"
9
+
10
+ CHECK_TO_INT = {
11
+ "reentrancy-eth": 0, "reentrancy-no-eth": 1, "reentrancy-benign": 2,
12
+ "reentrancy-events": 3, "arbitrary-send-eth": 4, "controlled-delegatecall": 5,
13
+ "suicidal": 6, "tx-origin": 7, "unchecked-transfer": 8, "unchecked-lowlevel": 9,
14
+ "low-level-calls": 10, "weak-prng": 11, "timestamp": 12, "unchecked-send": 13,
15
+ "incorrect-equality": 14, "missing-zero-check": 15, "events-access": 16,
16
+ "events-maths": 17, "access-control": 18, "deprecated-standards": 19,
17
+ "naming-convention": 20, "reentrancy-unlimited-gas": 21,
18
+ }
19
+
20
+ IMPACT_TO_INT = {"High": 3, "Medium": 2, "Low": 1, "Informational": 0, "Optimization": 0}
21
+ CONFIDENCE_TO_INT = {"High": 3, "Medium": 2, "Low": 1}
22
+ SEVERITY_TO_INT = {0: "LOW", 1: "MEDIUM", 2: "HIGH", 3: "CRITICAL"}
23
+
24
+
25
+ class ExploitabilityPredictor:
26
+ def __init__(self):
27
+ self._model = None
28
+
29
+ def _load(self):
30
+ if self._model is None and MODEL_PATH.exists():
31
+ self._model = joblib.load(MODEL_PATH)
32
+
33
+ def predict(self, finding: dict, contract_size: int) -> dict:
34
+ self._load()
35
+
36
+ if self._model is None:
37
+ return {"exploitability": "unknown", "confidence": 0.0}
38
+
39
+ check = (finding.get("check") or "").lower().strip()
40
+ features = pd.DataFrame([{
41
+ "check_id": CHECK_TO_INT.get(check, -1),
42
+ "impact": IMPACT_TO_INT.get(finding.get("impact", "Low"), 0),
43
+ "confidence": CONFIDENCE_TO_INT.get(finding.get("confidence", "Medium"), 1),
44
+ "contract_size": contract_size,
45
+ "num_elements": finding.get("occurrences", 1),
46
+ }])
47
+
48
+ pred = self._model.predict(features)[0]
49
+ proba = self._model.predict_proba(features)[0]
50
+ confidence = float(np.max(proba))
51
+
52
+ return {
53
+ "exploitability": SEVERITY_TO_INT.get(pred, "LOW"),
54
+ "confidence": round(confidence, 2),
55
+ }
56
+
57
+
58
+ # Singleton
59
+ predictor = ExploitabilityPredictor()