Getting Started
No. SIREEN works fully offline in heuristic mode. An API key is only needed if you want to enable optional AI-assisted hypothesis generation. You can use any LLM key (OpenAI, Anthropic, Google, DeepSeek, etc.) through OpenRouter — you are not locked into one provider.
Python 3.11+ and pip. Foundry (forge) is optional but strongly recommended if you want CONFIRMED findings. See the download page for full prerequisites.
SIREEN is tested on Linux and macOS. It should work on Windows Subsystem for Linux (WSL). Native Windows support is untested.
Findings and Results
A CONFIRMED finding means the generated PoC compiled successfully, ran through Foundry, and its security assertion passed. It proves the specific behavior exercised by the test — not every possible exploit variant.
The heuristic detected a suspicious pattern and generated a PoC, but Forge was unavailable or the test did not pass. A human must review the evidence and decide whether the finding is real.
No. It means SIREEN's current heuristics found no attack surface and every hypothesis received a Forge attempt. Business logic bugs, oracle manipulation, economic attacks, and novel vulnerability classes may still exist.
AI-Assisted Mode
Yes. SIREEN uses OpenRouter's free-tier models by default. No credit card is required.
We don't know yet. The AI pipeline is wired and functional, but we have not systematically evaluated whether it produces better findings than heuristic-only mode. Try it and let us know.
Yes, when AI mode is enabled. The contract source is sent to OpenRouter's API for analysis. Do not enable AI mode on sensitive or proprietary code you are not authorized to share.
Technical
Yes, but findings will be needs_review instead of CONFIRMED. You will still get hypotheses and generated PoCs, but no executable verification.
SIREEN analyzes Solidity source code directly. The generated PoCs use pragma solidity ^0.8.0. If your project uses a different version, you may need to adjust the PoC.
No. Only Solidity is supported at this time.
Reporting and Feedback
Contact the project owner through their GitHub profile with the contract source, the exact command, and the output. Include whether you were using heuristic or AI-assisted mode.
Open a GitHub issue describing the feature and why it would help. We prioritize features that improve the core verification workflow.