Vulnerability Library
Hawk-i ships 50 source-level detection rules covering the common classes of smart-contract vulnerability: reentrancy, access control, integer overflow, oracle manipulation, unchecked external and ERC20 calls, weak randomness, unsafe downcasts, ecrecover checks, upgrade safety, selfdestruct, locked ether, and code-hygiene issues such as outdated Solidity versions, floating pragmas, inline assembly, and deprecated constructs.
No dead rules
Every rule is backed by a liveness test: a crafted triggering contract is indexed through the real repository indexer and passed to the rule exactly as the scan pipeline passes it, and the rule must produce at least one finding. A rule that only works on hand-crafted inputs, or never fires in production, fails the suite. Adding a new rule requires adding its liveness trigger. The result is 50 rules that actually run, not a padded count.
Tested on real code
The rule set and the Deep agent have been run against real third-party corpora: Trail of Bits' not-so-smart-contracts, Damn Vulnerable DeFi, PancakeSwap's audited BNB Chain farming contracts (zero false criticals on production code), and DeFiVulnLabs' real incident reproductions, where the Deep agent invented and landed a live reentrancy drain in the sandbox (attacker balance grew from 1 ETH to 2 ETH).
Every rule pairs with supporting assets:
- A detection rule in Python, discovered automatically at runtime.
- A remediation template that populates the fix snippet in reports.
- For critical and high findings, an attack script the sandbox can run.
The plugin model
Extending Hawk-i means dropping a file in the right directory; no central registration. The directories and their contracts:
| Directory | Add |
|---|---|
static_rule_engine/rules/ | Subclass BaseRule, implement run_check. |
remediation_engine/templates/ | A JSON file; the filename stem is the rule id. |
exploit_sandbox/attack_scripts/ | A Python script following the runtime protocol. |
formal/ | Subclass Verifier, implement verify. |
monitoring/watchers/ | Subclass Watcher, implement check. |
ai_engine/prompt_templates/ | A JSON prompt template. |
Name coupling
The one rule to remember is cross-directory name coupling. A rule class name drives the ids of its companion files. For example ReentrancyRule gives rule id reentrancy, which maps to remediation_engine/templates/reentrancy.json and attack_scripts/reentrancy_attack.py. The names must line up across all three.
See the rules directory for the full list.