AI agents × Midnight

Audits anyone
can verify.

AI-agent audits for smart contracts, published as verifiable public reports.

Start an audit

Source, commit, compiler version and verifier keys are bound into a single report hash.

01 / Proof

Every line of code.
One hash.

The commit, the compiler version and every verifier key end up in one report hash anyone can check.

  • Scope agent: Maps the contract: circuits, ledger state, witnesses, entry points, who can call what.
  • Access control agent: Owner checks, roles, authentication of callers, privileged circuits.
  • Privacy agent: What becomes public on the ledger, use of disclose, witness data handling, linkability between transactions.
  • Funds agent: Token flows, balances, locked or unreachable funds, double spending paths.
  • Logic agent: State transitions, edge cases, arithmetic, assertions that can be bypassed.
  • Maintenance agent: Maintenance authority, verifier key replacement, upgrade and recovery paths.
  • Dependency agent: Compiler version, imported libraries, known issues in dependencies.
  • Review agent: Rechecks every finding from the other agents and discards those it cannot confirm in the code.
  • Report agent: Writes the final report in plain language, with locations and suggested fixes.
02 / Agents

Nine agents.
One verdict.

Each agent has one job. A review agent discards every finding it cannot confirm in the code. Meet the agents

  1. Source @ commit: Read from GitHub, no clone
  2. Build · hash: Verifier keys per circuit
  3. Static checks: Deterministic rules
  4. Agents ×9: Parallel analysis
  5. Review agent: Confirms or rejects
  6. Report: PDF · JSON · public page
  7. On-chain anchor: Midnight registry

Same code.
Same verdict.

Reruns review only what changed. Unchanged code keeps its findings, severity and wording. See the pipeline

03 / Pipeline

  1. Connect your repo

    Read-only GitHub App. No clone.

    • GitHub
    • Commit
    • Upload

  2. Run the agents

    Findings with severity, location and fix.

    • Findings
    • 3 runs
    • Diff

  3. Publish the proof

    Report hash anchored on Midnight.

    • PDF + JSON
    • Anchor
    • Badge

Paid in ADA.
From your wallet.

04 / Plans

Single audit

Most used

1000ADA

3 runs

One project, one audit.

Start an audit

Extra runs

+1

For an audit that used all its runs.

Builder pack

×n

For teams shipping several contracts.

  • Failed runs caused by 00trust don't count
  • Hackathon & community promo codes
  • Receipt for every payment
05 / FAQ

Questions.

All questions & glossary
01

Is a 00trust audit the same as a manual audit by a security firm?

No. It is an automated audit by AI agents and fixed checks. It is cheaper and faster, and it is honest about what it covers. Projects holding large amounts can use it before or alongside a manual audit.

02

Can I audit my contract if my repository is private?

Yes. 00trust reads the files directly from GitHub with read-only access and never clones the repository. You can also upload your code instead, and the upload is deleted after the run. Source code is never published.

03

Can I hide a bad report?

Yes, you can keep any report private. But a report can only be generated when there are no critical issues, and published reports show every finding and its status.

04

What happens when I update my contract?

The new version has new hashes. You start a new audit. The old report stays on your project page, linked to the old hashes.

05

What if someone changes the deployed contract after the audit?

If the deployed verifier keys no longer match the audited hashes, the public page shows the audit as outdated for that deployment.

06

Why ADA?

Midnight is part of the Cardano ecosystem, and ADA is the token builders in that community already hold.

07

Which AI models are used?

Models from providers such as Anthropic (Claude) and xAI (Grok). The exact model and version used is listed in every report.

00:00

Nothing is taken
on faith.

Connect GitHub1000 ADA · 3 runs