rextorsec/rextor-audit

**Rextor Audit** turns every pull request that touches money-code into an **audit event**: diff-scoped static analysis, fork simulation against live chain state, citation-constrained LLM triage, a deterministic risk score anyone can recompute — and the verdict **anchored on-chain, keyed to the commit**.
Built by **Rextor Security** — practicing auditors. The methodology that reviews your code is the same one we hunt bugs with.
> 🌐 Product is **live** at www.rextoraudit.com — install the app · example dashboard. Pre-alpha, building in the open for the Colosseum Crypto World's Fair (submissions close **Oct 12, 2026**).
Table of contents
- Why Rextor
- How a PR becomes an audit event
- Live receipts
- Integrity rails
- Capability matrix
- Quickstart
- Repository map
- Documentation
- Security
- License
Why Rextor
A traditional audit is a snapshot: weeks of expert review, then the code keeps changing. The riskiest window in a protocol's life — every merge after the report — runs unaudited.
Rextor closes that window. It sits in the pull-request flow, where code changes actually happen, and behaves like an auditor, not a linter: it reads the diff the way money moves through it, proves findings by executing them against forked state, refuses to guess when tooling breaks, and leaves a verdict anyone can verify on-chain — permanently.
Generic AI reviewers read code changes. **Rextor audits money changes.**
| | Point-in-time audit | Rextor (continuous) |
|---|---|---|
| Cadence | Once, at engagement | Every PR, forever |
| Method | Human expertise | Deterministic analyzers + fork-sim PoCs + cited triage |
| Verdict | PDF report | On-chain attestation, keyed to the commit |
| Recomputable | No | Yes — sha256 of the findings JSON = the on-chain findingsHash |
How a PR becomes an audit event
1. **Scope (1.0)** — the diff becomes an audit surface: changed functions, new callsites, trust-boundary deltas.
2. **Analyze (2.0)** — Slither + Aderyn run in Docker over the scoped surface. Deterministic, no LLM in this stage.
3. **Triage (3.0)** — the LLM may only reclassify, dedup, or add findings **with cited line ranges**. Tool failure marks the report INCOMPLETE — never a fabricated clean pass.
4. **Prove (4.0)** — confirmed findings get execution-proof PoCs: fork simulation against live chain state (liteSVM / Foundry fork).
5. **Score (5.0)** — a deterministic rubric maps findings → riskScore. Recomputable by anyone from the findings alone; no hidden weights.
**Anchor** — the verdict is attested on the chain the code targets: attest(reviewId, commitHash, findingsHash, riskScore, status). Three surfaces come out: the PR comment, a merge-gating check-run, and the public on-chain attestation.
Live receipts
> **Receipts, not claims.** Every number below is probeable right now. Counts as of **2026-09-22**.
| Chain | Attestation contract | Receipt | Explorer |
|---|---|---|---|
| **Tempo testnet** (chain 42431) | 0x51ac…495a | **5 attestations** · agent active | explore.testnet.tempo.xyz |
| **HyperEVM mainnet** (chain 999) | 0x8f63…850c | agent active · 0 attestations | hyperevmscan.io |
| **Solana devnet** | Aj6Nx…kMDs | adapter live | explorer.solana.com |
**Agent identity** — registered on the canonical ERC-8004 registry as **agentId 50891** (eip155:1:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432): mint transaction · operator feedback 95/100 · identity URI ipfs://QmcKWrvJvDEQinnUvUEd2v36ERF247QezssjfXEbc6QMAr.