ICICPE 2026 · F1 0.948 agreement with Slither

Score the 95% of mainnet
your scanners can't even open.

REVERT scores raw EVM bytecode in ~1 ms and ranks which contracts your auditors and deep tools open first — by attack surface, not alphabetical. It works on the ~95% of Ethereum mainnet that ships unverified, where Slither, Aderyn and MythX return nothing — calibrated to agree with Slither 94.8% of the time (held-out F1), running where Slither can't even start.

Built for senior auditors, audit firms, and DEX / bridge security teams who have to decide what to review first.

Triage, not audit: a high score means review-priority, not a confirmed bug; a low score is never a safety guarantee.

~95% of mainnet ships unverified — no source tool can open it
0.948 F1 agreement with Slither · 11,670 held-out contracts
2 of 3 major exploits flagged red from bytecode, weeks before the hack
// live scan · model xgb-2025-12-28  api online · eth mainnet

Paste any mainnet contract — verified or not — and see its risk score in ~1 ms.

// try:
paste address · click REVERT
awaiting input
Real-time scan against xgb-2025-12-28 · bytecode-only.
117 091 contracts trained 11 670 held-out · served XGBoost 70 features MIT + Apache 2.0

Two of three major exploits scored high-risk from bytecode alone — weeks before they happened.

Backed by the held-out test: F1 0.948 agreement with Slither across 11,670 contracts — measured on verified contracts where Slither can read source. That is agreement, not vulnerability ground-truth, and not yet directly validated on the unverified domain the tool runs on (the signal transfers via shared compiler/opcode features) — treat the score as attack-surface triage, not proof of a bug. Below — what the model scored on the runtime bytecode that was live before each exploit, with no knowledge of the hack (n=3, illustrative — no base rate). We publish our misses too. High = review-priority, not a confirmed bug. Full method & limitations → /methodology.

Tool Reads Speed Scope
REVERT bytecode (verified or not) ~1ms attack-surface / complexity triage · Slither-correlated patterns
Slither / Aderyn / MythX source code only seconds–minutes deep general-vuln analysis · needs the ~5% with source
GoPlus / honeypot scanners bytecode + on-chain fast scam / honeypot signals — not general vulns
Dedaub bytecode slow / deep decompilation & deep analysis — not fleet-scale triage

REVERT owns the one column the others leave empty: instant, fleet-scale triage on the ~95% of mainnet that source tools can't open — calibrated to agree with Slither, and not a scam detector.

Nomad Bridge
2022-08-01 · $190M · unchecked-calls + init
0.989high-risk · scored pre-hack
Curve · vyper
2023-07-30 · $11M · pETH pool · reentrancy via raw_call
0.982high-risk · scored pre-hack
Euler Finance · we missed this
2023-03-13 · $197M · logic behind a Module/Dispatcher proxy
0.004missed · outside scored bytes

Three things make it work.

No source maps, no symbolic execution, no LLM hallucination. Just opcodes, statistics, and an open, reproducible preprint — dataset and model card published (ICICPE 2026).

01 / bytecode
Bytecode-only.
No source needed.

We parse compiled EVM directly — opcode histograms, control-flow shape, storage-write patterns, selector entropy. Works on every Ethereum contract, verified or not — no source required.

95% · of mainnet ships with no verified source
02 / model
Reproducible math.
Not vibes.

XGBoost classifier trained on 117,091 Slither-labelled Ethereum contracts, 70 hand-engineered bytecode features (served model). Served binary any-vulnerability F1 = 0.948 (agreement-with-Slither on held-out data); 8-class SWC macro-F1 = 0.75. Per-class precision shipped in the paper. Actively maintained; v1.2 corpus refresh in progress.

0.948 · binary F1 · 11,670 held-out contracts
03 / triage
Built for the
triage queue.

One REST call scores a contract; the batch endpoint scores 25 at once and returns them ranked. Resolve proxies to their implementation, separate the unscannable from the merely complex, and route anything above your threshold to manual review — straight from your pipeline.

~1 ms · per contract · single CPU core

Pay for what you scan.

One bytecode-risk API, metered by scans per month. Generate a free key in the dashboard and make your first call in under a minute — read the API docs →

Free
Indie auditors. Trying it out.
$0 / mo
100 scans / month
Sign in for a free key
  • POST /api/v1/scan + per-contract SHAP
  • Batch endpoint (up to 25 / call)
  • Proxy → implementation resolution
  • Self-serve key, no card
Team
Audit shops. DEX security teams.
$399 / mo
50 000 scans / month
Start Team — pay with USDC
  • Everything in Pro
  • 5 keys · score diff across deploys
  • Private support channel
Enterprise
Bridges. L1 / L2 foundations.
Custom
unlimited · SLA
Contact sales
  • Everything in Team
  • On-prem deploy option
  • Dedicated SLA + onboarding

Free-tier keys are self-serve right now. For Pro/Team, pay in USDC — we activate by hand within hours, no card. Annual billing = 12 months for the price of 10. Self-serve metered checkout comes later.

🔒 Signed-in scans stay yours. The public feed shows only a non-reversible hash of each address — never the real contract (enforced in code). Authenticated scans are private (row-level security) and never reused for our bounty research. Free/anonymous scans are hashed in the public feed but retained to improve the model — sign in (or go Pro) if a contract you're investigating must not be stored.

Questions worth asking.

Straight answers — the kind a security engineer would ask.

Is REVERT a vulnerability detector?

No — and we won't pretend otherwise. REVERT is a triage pre-filter: it scores how much risk surface a contract's bytecode carries and ranks what deserves a human's attention first. A high score means review-priority, not a confirmed bug. It solves "which of these 5,000 contracts do I even open?" — not the audit itself.

Does a low score mean the contract is safe?

No. Low risk ≠ safe. A low score means REVERT didn't see the structural patterns it's trained to flag — not that the contract is free of bugs. Treat it as "nothing jumped out," never as a clean bill of health.

How is this different from Slither, Aderyn, or Mythril?

Those are excellent — when you have the Solidity source. But roughly 95% of deployed mainnet contracts are unverified, and source-based tools can't open them. REVERT scores raw bytecode in ~1 ms per contract, so you can rank an entire portfolio of unverified addresses in one pass and decide where the source-based tools — and your auditors — should dig.

What is the model trained on, and how accurate is it?

A gradient-boosted classifier trained on ~117K Slither-labelled contracts (binary F1 0.948). It's a fast, bytecode-only risk model calibrated to Slither's judgment: it agrees with Slither ~95% of the time but runs on the contracts Slither can't read. Full metrics and limitations are on the Methodology page and in the ICICPE 2026 paper.

Which chains are supported?

Ethereum mainnet today. The model is bytecode-only, so EVM-equivalent chains are a roadmap item — tell us which one you need.

How do I start, and how does billing work?

Generate a free key in the dashboard (100 scans/month, no card) and make your first call in under a minute. For Pro/Team, pay in USDC — activated by hand within hours, no card. Read the API docs →

Find the 10 contracts worth your time —
out of 1,000.

Try a scan
no signup for the first scan · 100 free scans / month · paste an address