Working PoC drained 142 ETH on forked mainnet
Security state for agentic Robinhood apps
Agents write code, install packages, deploy contracts, and move funds. HexRail gives them a preflight security layer at every step — MCP while coding, Guard before interaction, receipts for explainability, EAS for proof, Oracle for onchain reads.
Onchain attestations
—
EAS · Robinhood
Oracle-seeded contracts
—
Canonical Robinhood list
ERC-8004 agent
—
Robinhood · onchain identity
Reputation
Building
ERC-8004 reputation
while coding
MCP server
Drop into Claude Desktop, Cursor, Cline, Zed. Tools: scan, scan-address, replay-hacks, agent-identity.
Setup →in CI
CLI · GitHub Action
Run on every commit. Same engine as the dashboard. Exit non-zero on critical.
CLI →before interaction
Agent Guard
Preflight signal for any Robinhood address. low_risk_signal · review · block_for_review · needs_scan. Free, no auth.
Try Guard →agent-to-agent
x402 paid scans
HTTP 402 + X-PAYMENT-REQUIRED. $0.01 USDC per scan, $0.02 per review. Robinhood + Solana.
API spec →proof
EAS attestations
Every paid scan mints an attestation on Robinhood mainnet. Receipt + UID returned to caller, public on easscan.
Live feed →onchain reads
HexRailOracle · GateRegistry
scoreOf(address) in one staticcall. Reference registry coming to Robinhood. Drop into v4 hooks, vaults, routers.
Oracle →continuous monitoring
Watcher
HexRail watches new Robinhood contract deployments and scans contracts when verified source is available. Static-only, best-effort, public receipts.
Live feed →Not an audit. Not a safety guarantee. A preflight layer agents and apps can consult before they act.
Hack Replay
12 famous exploits. Encoded as detection patterns.
We’ve encoded the attack vectors from the biggest crypto hacks of the last 24 months into Foundry replay templates. HexRail runs every one against your contracts before you ship — so you don’t ship the next headline.
Bybit
Frontend tampering
Stolen
$1.46B
HexRail catches: CI/CD pipeline integrity, frontend SRI checks, build artifact signing.
Radiant Capital
Multisig UI hijack
Stolen
$53M
HexRail catches: Privileged function inventory, ownership-transfer detection, timelock gating.
Euler Finance
Donation reentrancy
Stolen
$197M
HexRail catches: Health-check interaction analysis, donation/burn path reentrancy, invariant fuzzing.
zkSync Airdrop
Unguarded admin sweep
Stolen
$5M
HexRail catches: Admin-mint detection, timelock requirement on privileged functions, multisig scope review.
Apr 2022 · Flash-loan governance
Jul 2023 · Single-admin bridge
Mar 2022 · Low validator threshold
Jul 2023 · Vyper compiler bug
Audits are point-in-time. Hacks aren’t.
Engine has 12 hack patterns encoded today — Bybit, Radiant, Euler, zkSync above, plus Beanstalk, Multichain, Ronin, Curve, Cream, Wormhole, Nomad, Mango. New vectors added every time a major exploit hits.
Smart contract security
Built for the onchain stack
Post-Cancun EVM, Uniswap v4 hooks, EIP-7702 delegation — HexRail detects the bugs that matter before they cost you a treasury.
initialize() lets anyone seize the account.tstore costs 100 gas — enough for a reentrancy callback that defeats your transient lock.40+ Solidity & DeFi rules — covering Cancun opcodes, ERC standards, and AMM hook patterns.
All regex-based pattern detection. For deep symbolic execution, pair with Slither or Medusa.
End-to-end flow
From messy commit to clean patch.
HexRail turns risky diffs into reviewable fixes before they reach production.
Platform
One engine. Four loops.
Every commit runs through the full pipeline — automatically.
Scan
Parse code and detect risky patterns across every changed file.
Score
Prioritize by severity, confidence, and cleanup impact.
Fix
Generate safe, structured patches that are easy to review and commit.
Verify
Re-scan changes before they ship to confirm issues are resolved.
Under the hood
Pipeline internals
Pattern matching + AI hybrid. No data collection, no internet required for static mode.
Parse
Git diff → AST extraction. Language detection across 8 runtimes. Hunk isolation to exact line ranges.
Detect
180 detectors evaluated per hunk. Confidence scoring via AST + regex hybrid engine. Dedup and rank.
Score
CVSS-inspired severity weighting. Cumulative penalty model with per-finding confidence thresholds.
Fix
Context-aware patch generation. Structured diffs, not full rewrites. One-click commit integration.
Detection coverage
What HexRail catches
180 detectors across security, smart contracts, IaC, CI/CD, and code cleanup. Every finding comes with a suggested fix.
Smart Contract / DeFi
Reentrancy, EIP-7702 delegation bugs, TSTORE post-Cancun, Uniswap v4 hook vulnerabilities, and Solidity-specific antipatterns. Plus 12 famous-hack replay templates.
Hardcoded Secrets
API keys, tokens, passwords, and private keys hardcoded in source files.
Injection Risks
SQL, command, and template injection via unsanitized input across query patterns.
Auth Mistakes
Missing auth checks, weak JWT configs, insecure session and cookie handling.
Unsafe Logic
eval(), dangerouslySetInnerHTML, prototype pollution, and unsafe deserialization.
IaC & Infrastructure
Terraform misconfigs, Kubernetes privilege escalation, exposed S3 buckets, and GitHub Actions injection.
Code Quality
Unused vars, N+1 queries, missing error handling, dead code, and complexity hotspots.
Privacy
Local-first by design
Your source code is your most sensitive asset. HexRail never asks you to upload it.
No code upload
The CLI runs entirely on your machine. Source code never leaves your environment by default.
Air-gap compatible
Static analysis runs fully offline. Works in locked-down environments without internet access.
npm-installable engine
Published as @hexrailsec/engine on npm. Embed in your own tooling, run via the CLI, or call our paid API.
“Run npx -y @hexrailsec/cli scan . — results in seconds, nothing uploaded, no account required.”
The honest version
What HexRail is — and isn’t.
Read this before you wire HexRail into anything that touches user funds.
- ✓A fast first-pass security scanner — runs 180 detectors in <1s, surfaces real issues alongside hygiene findings.
- ✓Useful right before a PR merge, a token launch, or handing off to an audit firm.
- ✓Strong at known exploit patterns, hardcoded secrets, infra/IaC mistakes, risky Solidity patterns, and CI/CD supply-chain issues.
- ✓Generates working Foundry PoCs for some high-severity Solidity findings — runs them against a forked mainnet to confirm real exploitability.
- ✓Every paid scan posts a permanent attestation on Robinhood via EAS — public, verifiable, queryable.
- ·A replacement for a full human audit. Anything moving >$5M should still be reviewed by humans.
- ·A guarantee that your code is safe — a clean HexRail grade means no patterns matched, not that no bugs exist.
- ·A symbolic execution engine. Pair HexRail with Slither or Mythril for proof-style guarantees on critical functions.
- ·A business-logic auditor for complex protocols. HexRail cannot tell you that your vesting math actually does what your whitepaper says it does.
- ·Continuous autonomous scanning of every onchain contract. That is the roadmap; today it is on-demand and PR-time.
The honest positioning: HexRail is the layer everyone needs before an audit — fast, cheap, agent-callable, with onchain proof. It is not, and we do not claim it is, the layer that replaces one.
Pricing & $HEX
Pay per scan. Token is optional.
Most of HexRail is free. Paid scans cost cents in USDC. $HEX is coming to Robinhood — it's a community token that helps route attention toward public security coverage. It is not required to use the product.
Playground
Free
Rate-limited
Paste code or a contract address. 180 detectors. 12 hack-replay templates. Public receipt page generated for every scan.
Static scan
$0.01
USDC · pay via x402
Same engine, no rate limit. Onchain EAS attestation lands on Robinhood under your wallet. No signup.
AI deep review
$0.02
USDC · pay via x402
Claude reads findings + diff, explains in plain English, writes fix diffs. Foundry PoC generation on critical Solidity findings.
Token · coming to Robinhood
$HEXHexRail
Contract address
Address — coming soon
Chain ID — published at launch (Robinhood mainnet). The contract address will be published here once deployed — always verify it on the Robinhood explorer before interacting.
What $HEX is — and isn't
What it is, today: a community token. Signal and coordination — directing which contracts the agent prioritises and what hack patterns we encode next. Helps fund agent compute, scheduled public scans, and continued investment in the open hack-replay rule library.
What it isn't: not a security. Not a profit-share. Not a claim on revenue. Not required to use the scanner, MCP, CLI, Guard, Oracle, or Watcher. Paid scans continue to use USDC via x402. Free scans continue to be free.
Future token-gated utilities (priority queue, scan credits, community-submitted scan targets) may be added only after the underlying systems are built and tested. Anything not shipped today is roadmap, not promise. Nothing on this page is investment advice.
Start scanning in 30 seconds.
No account. No upload. Just clean code.