Overview
HXIDE is a browser-based, defensive smart-contract audit aid. You paste Solidity or Vyper source (or import verified code by address on EVM chains), and it returns a structured report: a vulnerability meter, a security score, and per-finding severity, location, impact, fix and a confidence estimate.
Two analysis passes
Local static pass
A set of pattern rules runs instantly in your browser and flags well-known risk markers such as tx.origin, low-level call{value:}, delegatecall, selfdestruct, compilers below 0.8, and blockhash-based randomness. It is free, deterministic and offline.
AI review
The pasted code is sent to the Mistral API with a defensive-auditor prompt. It reasons about logic the static pass cannot, including business-logic flaws that are specific to each contract.
Ecosystem profiles
HXIDE auto-detects the target ecosystem. For EVM it focuses on reentrancy, access control, oracle manipulation, MEV and arithmetic. For Solana (Rust/Anchor) it switches to signer checks, account validation and PDAs. For Move (Aptos/Sui) it targets capabilities and resource safety.
Exports
- Markdown / JSON / HTML / PDF — human and machine-readable reports.
- SARIF 2.1.0 — for GitHub code scanning and CI pipelines.
- Slither / Mythril CLI — reproduce findings with deterministic tooling.
- GitHub issue template — paste findings straight into a tracker.
Privacy & API keys
The app runs locally. Your Mistral key stays in your browser session and is never stored on a server by the tool. For production hosting, use the bundled proxy so keys are never exposed client-side.