Uncover the risks hiding between the lines. CurveYield combines source-first analysis, adversarial reasoning and traceable evidence in a focused EVM security assessment.
Every phase has a purpose. Follow how submitted code becomes a source-bound security assessment through architecture mapping, threat modeling, adversarial reasoning, genuine execution evidence where required, and validated findings.
Bound the submitted source archive, source hash, deployment/build identity, dependencies and available machine-generated static/security evidence before review begins.
Map in-scope contracts, key functions, architecture, external dependencies, privileged pathways, and the boundaries of what can be examined.
Compare intended protocol behavior, NatSpec, documentation, state transitions, invariants, and assumptions against the implementation under review.
Track authority boundaries, roles, external integrations, economic assumptions, adversarial preconditions, and threat scenarios to structure subsequent discovery.
Examine reachable flows and residual code units; compare implementation with intended behavior; independently within the same agent role perform an adversarial reasoning pass; reconcile and preserve candidate observations. The Demo Audit concludes after this phase.
Prepare concrete target-specific verification designs and, where expressly authorized, executable harnesses and machine evidence for the source and deployment identity being assessed.
Use archive-fork and other genuine evidence where required and authorized. Preserve unresolved coverage or unavailable evidence instead of interpreting missing proof as a secure result.
The existing controller materializes its Phase 7 evidence marker when preceding evidence has been accepted. This is not an additional independent audit reviewer.
Validate and consolidate recorded candidates without losing distinct failure mechanisms. Determine whether the available source, reasoning, and execution evidence support a defensible security finding.
If remediation is available, examine the proposed changes and the effect on earlier findings. Where none exists, the controller records this phase as skipped rather than inventing remediation work.
Prepare the source-traceable final report with security conclusions, material open risks, remediation guidance, and the limitations of the assessment. Completion requires controller-confirmed acceptance.
Choose an early-stage discovery snapshot or a complete evidence-based review. Each higher tier adds expertise rather than replacing source traceability.
Quick visibility into potential security risk before commissioning the full investigation.
Complete Lite-Solo audit pathway with final source-bound findings and documented limitations.
Expanded model perspectives: Fable Max UltraCodeReview and Astara Max Intelligence.
Human Auditor Review with increased adversarial review testing.
Launch a $19 demo audit or purchase a full assessment. Every payment counts toward a higher tier, and results use the email you provide at checkout.
The Phase 4 demo identifies preliminary candidates, not confirmed vulnerabilities. Tier 1–2 follow the single-auditor Lite-Solo authority; no independent reviewer is implied. Tier 3 dual-model review and Tier 4 human review are additional services that require operational provisioning. Authorized execution evidence and conditional remediation requirements remain governed by the audit process.
Our Lite-Solo framework moves from verifiable source identity through threat modeling, separate correctness and adversarial reasoning passes, evidence-driven investigation and finding validation. Each stage has a defined purpose—not a checkbox.
Find your coverage levelEstablish source archive, dependency, build and deployment identity before review.
PROVENANCE FIRSTUnderstand architecture, privileged roles, asset flows, invariants and attack surfaces.
THREAT MODELINGSeparate correctness and attacker-focused passes, then reconcile observations into candidates.
DEMO FINISH LINEDesign evidence-backed execution, including archive-fork investigation when required and authorized.
MACHINE EVIDENCEVerify candidates, document remediation when applicable, and deliver traceable findings and limitations.
ACTIONABLE REPORTThe audit is bound to submitted source and deployment context so findings can be traced back to the material examined.
Correctness analysis checks intended behavior; adversarial analysis searches for abuse of assumptions, roles and transaction paths.
Machine analysis and execution evidence support conclusions. Unresolved questions remain visible rather than being silently dismissed.
Validated candidates, severity, impact, source references and known limitations inform remediation decisions.
Lite-Solo is a single-agent assessment; the two Phase 4 reasoning passes are not independent reviewers. Phase 7 is automated, Phase 9 applies when remediation is present, and mandatory evidence cannot be waived when required. Higher-tier dual-AI and human review are additional services.
Security review should tell you what can fail, why it matters, and what the evidence actually supports—not just produce a certificate.
Review bound to the actual submitted archive, dependency context, contract roles and deployment assumptions.
Correctness and attacker-oriented passes explore trust boundaries, transaction flows and abuse scenarios.
Findings, uncertainties, scope limitations and remediation recommendations are carried into a traceable final report.
A structured Lite-Solo pathway with controller-validated phase boundaries and evidence requirements.
Provide a ZIP of EVM contracts, context and deployment material to establish a fixed review scope.
Establish system purpose, trust boundaries, protocol invariants and realistic failure modes.
Correctness, attacker reasoning and evidence-backed execution where required and authorized.
Reconcile candidates, document findings, recommendations, and the limits of the review.
A focused single-auditor Lite assessment, designed for EVM contracts and informed by the CurveYield Lite-Solo v2 authority. Coverage varies with code complexity, scope and evidence availability.
Read the audit authority ↗Important: Lite-Solo is a single-auditor workflow. It does not include independent multi-reviewer assurance and must not be represented as a Full audit.
Start small, go deeper when you’re ready. Every paid package can be upgraded to a higher tier by paying only the difference.
See what our security engine can uncover before committing to a full assessment.
Our evidence-first, structured Lite-Solo assessment using Sol at High Intelligence.
The Tier 1 coverage with an enhanced reasoning model for deeper analysis.
Two high-intelligence review passes for expanded adversarial perspective.
Expert human oversight plus more intensive adversarial review and testing.
*Launch prices are 50% of the planned regular list prices shown crossed out, not a claim of historical sales at those rates. Timelines are typical estimates, not guarantees; scope and available execution evidence may affect completion. Candidates from Phase 4 are preliminary observations, not confirmed vulnerabilities.
Choose the review depth that fits your project, enter the email where we should send results, and provide a private source ZIP.
Tier 1 Essential · Most audits completed within 24 hours
Secure source intake is separate from audit execution. The audit controller must be connected and admit each submission before audit work begins. Payment does not guarantee a finding or eliminate code risk. Payments on Base are irreversible; refunds require operator handling.
Native USDC on Base • No token approvals required • Never share your private keys.
Your verified payment and ZIP file are securely recorded for audit intake. Keep your reference ID for support.
Save the private receipt ID and token to retrieve your demo result or upgrade later.
Return to top ↑Every dollar of your completed purchase counts toward any higher-tier package. Your $19 demo credit also applies in full.
Enter your existing receipt to calculate your exact remaining USDC payment.
We run the prescribed assessment through Phase 4 and report the total number of recorded security candidates. You receive short descriptions of at most the first five. Phase 4 candidates are not yet final validated vulnerabilities or a complete audit report.
Yes. You receive a full credit for completed payments toward a higher tier at the current launch-sale rates. For example, Tier 1 → Tier 2 costs $288, Tier 2 → Tier 3 costs $300, and Tier 3 → Tier 4 costs $600. The original demo $19 is also creditable.
Most Tier 1, 2 and 3 audits complete within 24 hours. Tier 4 audits usually complete within 3 business days. These are typical targets rather than guaranteed turnaround commitments; complexity, scope, and scheduling can extend delivery.
Tier 1 uses Sol High Intelligence; Tier 2 upgrades to Astara Max Intelligence. Tier 3 adds Fable Max UltraCodeReview alongside Astara Max Intelligence for dual AI review. Tier 4 also includes a human auditor review and increased adversarial review testing. Independent multi-reviewer and human services are add-ons beyond the base Lite-Solo process.
No. The published Lite-Solo authority expressly defines a single substantive auditor. Later evidence phases require source-bound machine evidence and validated findings. Dual AI review and human auditor review are separate upgrades.
Upload one ZIP of EVM code, deployment context and dependencies, excluding private keys and secrets. A valid client email is mandatory for every package and stored with the engagement. If outgoing email is configured, confirmations and demo summaries can be emailed; your secure receipt also permits viewing demo results.
The Worker verifies USDC transfers and securely stores your ZIP. Launching a controller campaign and completing the selected audit require the separate CurveYield audit execution pipeline and operator integration; the marketing intake alone does not execute code analysis.