Methodology

DappVet is an automated pre-audit. It runs the same deterministic checks on every target, publishes a score, and sells a deeper report with evidence, fixes and an AI code review. It is not a manual security audit.

Smart contracts

Supported chains: Ethereum, Base, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche.

  • On-chain facts from public RPC: contract code, ERC-1967 proxy and beacon slots, the current owner().
  • Verified source from Sourcify (or Etherscan when available). Unverified code is itself a high-severity finding: nobody can review it.
  • Token behaviour simulation from GoPlus: honeypot, sell restrictions, taxes and whether they can change, hidden owners, minting, pausing, blacklists, holder concentration.
  • Pattern checks over the verified Solidity (vendored libraries such as OpenZeppelin are skipped): selfdestruct, tx.origin authentication, delegatecall, unprotected initializers, unguarded external calls, uncapped fee setters, weak randomness, raw ecrecover and more.

dApp frontends

  • DNS and DNSSEC over DNS-over-HTTPS, hosting detection, dangling CNAMEs.
  • HTTPS redirect, HSTS and security headers (CSP, framing, referrer, permissions).
  • The homepage HTML and a budgeted number of JavaScript bundles, checked for leaked keys and mnemonics, exposed source maps, known wallet-drainer indicators and risky patterns.
  • Passive by default: DappVet only fetches what a browser visiting the homepage would fetch, plus DNS and /.well-known files. No directory probing, no forms, no login attempts.
  • Active checks (exposed files, CORS, open redirects, unauthenticated APIs, vulnerable dependencies) run only for verified-owner scans, after the owner proves control with a DNS record or a wallet signature.

Scoring

Every target starts at 100. Each finding subtracts points by severity — critical 35, high 18, medium 8, low 3, info 0 — and each repeat of the same severity counts 0.7× the previous one, so many small issues cannot outweigh one critical. Grades: A ≥ 90, B ≥ 75, C ≥ 55, D ≥ 35, otherwise F. Contracts and frontends use the same formula, so scores are comparable. AI findings never change the public score.

Scores are cached for 6 hours. Anyone can rescan; a fixed issue disappears from the score on the next scan.

The deep report

The paid report adds evidence excerpts, file:line locations and fixes for every finding, plus an AI review of the code or frontend. AI findings are ranked below deterministic ones, carry a confidence value and are labelled "needs confirmation". The report lists what was not checked.

What a score does not mean

A high score means the automated checks found little. It does not prove a contract is safe, that a team is honest, or that the economics work. A low score is not an accusation. Business logic, off-chain systems, key custody and anything behind a wallet connection are not covered.