A program that runs on a blockchain. It stores data and executes logic automatically when certain conditions are met. Because it handles valuable assets, bugs in smart contracts can lead to direct financial loss.
A weakness in a program that an attacker could exploit to cause harm. In smart contracts, common vulnerabilities include reentrancy (stealing funds through recursive calls), missing access control (anyone can call privileged functions), and arithmetic overflow (incorrect calculations).
An educated guess that a specific part of a smart contract might be exploitable. A hypothesis includes what you suspect, which function is involved, and what preconditions would need to hold for the attack to work.
AttackScenario object with entry points, preconditions, and attack vectors.A test designed to demonstrate whether a suspected security weakness can actually produce the described behavior. A PoC is not a complete exploit — it is a focused test that checks one specific claim.
.t.sol) that inherit from forge-std/Test.sol. Each PoC contains setUp() and testExploit() functions with security-relevant assertions.A toolkit for building and testing Solidity smart contracts. It includes forge (the compiler and test runner), cast (for interacting with contracts), and anvil (a local blockchain for testing).
forge test to compile and execute generated PoCs. Foundry must be installed separately. Without it, SIREEN can still generate hypotheses and PoCs, but cannot produce CONFIRMED findings.Terminal States
Every SIREEN audit ends in one of five explicit states. No generic "success."
Forge verified. Evidence complete.
Incomplete verification. Manual review required.
Hypothesis only. Nothing executed.
Pipeline error. No claim made.
No findings. All hypotheses tested. Not a guarantee.
A finding that has been proven by executable evidence. The generated PoC compiled successfully, ran through Foundry, and its security assertion passed. This is the strongest level of confidence SIREEN provides.
CONFIRMED when verification.compile_status == "passed" AND verification.test_status == "passed" AND the PoC contains meaningful security assertions (not trivial assertTrue(true)).Pattern-based detection that looks for known suspicious code structures. For example: "this function makes an external call before updating state" is a heuristic pattern associated with reentrancy.
Optional enhancement where a language model suggests additional attack hypotheses beyond the heuristic patterns. The AI can propose novel angles but its output is not proof — every suggestion still needs Forge verification.
AttackScenario objects and processed identically to heuristic hypotheses.A passing PoC confirms the behavior exercised by that specific test — not every possible exploit scenario, not the absence of other bugs, and not formal correctness of the entire contract. Always combine tool output with manual review.