GitHub App

A security review on every pull request that touches a contract.

Teams ship contract code every week. Install Monsmith once and every pull request that changes Solidity gets a full audit, the findings on their lines, a running count of what each push fixed, and an onchain attestation when it merges.

Install on GitHubRun one report by hand first

Free for 60 reviewed pushes per installation every 30 days. Pick the repositories it may read; it asks for nothing else.

On a real pull request

A staking vault in our demo repository. The pull request added reward sharing with three bugs in it. Three pushes later the score had gone from 15 to 41 to 52, six findings were fixed before merge, and the merged code was attested on Monad.

Monsmith's comment on the demo pull request: score 52, up from 15 at the first review, attested on Monad, with the findings each push fixed struck through.

How it works

  1. 1.A pull request changes a contract

    Opened, pushed to, or marked ready. Drafts wait. Pull requests that touch no Solidity are left alone, and tests, scripts and dependencies are never audited.

  2. 2.The changed contracts get a full audit

    The same engine as a report run by hand: a threat model written for this contract, a hunt for exploits against it, a second model cross-examining every finding, and the static and gas passes.

  3. 3.One comment, kept up to date

    Score, findings worst first, each linked to its line at the reviewed commit, and a check run that puts them on the lines in Files changed. Later pushes edit the same comment, never add another.

  4. 4.Each push says what it fixed

    A new push re-checks the earlier findings one by one and re-audits the changed contract in full, so the comment can say which findings that push fixed and whether it introduced any.

  5. 5.Merged code is attested on Monad

    When the pull request merges, Monsmith reads the merged files and, only if they are byte for byte what it reviewed, writes their score onchain under its ERC-8004 identity. Anyone can check it before calling the code.

The numbers we are judged by

Not comments posted. Teams that keep it installed, and fixes that merge because of it. Live from the database, with our own account (Adwaitbytes) left out.

0
Teams installed
n/a
Still running at week four
Installed 28+ days ago, still installed, reviewed a pull request in the last 14 days.
0
Pull requests reviewed
0 pushes in all
0
Findings fixed before merge
Gone after a later push to the same pull request.
0
Fixes merged
Across 0 merged pull requests
0
Merges attested on Monad

What it can touch

  • Contents, read only, on the repositories you pick, to read the Solidity at the pull request's commit.
  • Pull requests and checks, write, for its one comment and its one check run. It never pushes code, approves, or merges.
  • Monsmith keeps the report it writes (findings and short excerpts of the code they rest on) so the comment can link to it and the next push can be compared with it. It does not keep a copy of your repository.