jevscan-evm
Proof-of-concept scanner that asks Jev hundreds of bug questions per Solidity file and writes a heat map of likely vulnerabilities.
Overview
jevscan-evm produces a heat map of likely bugs in EVM smart-contract code using Jev. For each file it asks two general questions (is there any exploitable bug, and is there a bug that lets an attacker steal or lock funds), 14 category questions drawn from the OWASP Smart Contract Top 10, SWC and Immunefi, and 343 detector questions sourced from the Cyfrin audit checklist and evm-cortex. Results are written to a HEATMAP.md with per-file probabilities.
The README's example on a Sherlock audit contest reports an 89% chance of a critical bug and names the hottest file, and compares speed and cost per file against a reasoning LLM. The author warns plainly that it is a fully 'vibe-coded' proof of concept whose code they did not read, to be used at your own risk. It is aimed at auditors wanting a fast, cheap first-pass triage of where to look.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is there any exploitable bug in this file? | — |
| Yes / no | Is there a bug that lets an attacker steal or lock funds? | — |
| Yes / no | Does this file exhibit this specific vulnerability category or detector? | — |
How it works
- Point jevscan.py at a repository
- Selected Solidity files are sent with general, category and detector questions
- Jev returns probabilities per question
- Results aggregate into a per-file heat map in HEATMAP.md
Strengths
- Seconds and pennies per file, per the README
- Detector questions drawn from established audit checklists
- Configurable file selection and thresholds
Caveats
- Author states they did not read the code
- Probabilities indicate where to look, not confirmed bugs
- Source code is sent to the hosted API
Getting started
git clone https://github.com/devtooligan/jevscan-evm.git && cd jevscan-evm && pip install aiohttp, set TYPESAFE_API_KEY in .env, then python jevscan.py /path/to/repo.At a glance
- Type
- Project
- Status
- prototype
- Language
- Python
- Runtime
- CLI script
- Has code
- yes
Use cases and integrations
How curated lists describe it
Produces a heat map of likely bugs in EVM code. The author's own warning: a proof of concept whose code they did not read.
MrJev/awesome-jev
Frequently asked questions
What does Jev decide?
The probability that each file has exploitable bugs, fund-loss bugs and each of hundreds of specific vulnerability patterns.
Is it a replacement for an audit?
No. The author calls it a proof of concept and the output is a heat map for prioritising review.
How many questions does it ask?
Two general, 14 category and 343 detector questions.
Related projects
CLI that scans source, build and CI files with Jev for hidden, deceptive or data-stealing behavior before you run unfamiliar code.
CLIbetaTypeScriptUnix-style tools where Jev learns a repo's decision norms and judges each node of a code lead as a bug, lead or clean.
ProjectbetaJavaScriptRust code and security reviewer that asks Jev staged questions about diffs and posts findings with severity and owner routing.
ProjectbetaRustSemantic code linter that reads each method with its callers and callees and asks decision models about defects, kind, line and severity.
CLIbetaTypeScriptStaged code-review workflow for JS/TS where Jev screens risk, picks evidence, classifies mechanism, scores severity and routes reviewers.
AppprototypeTypeScriptRust CLI that classifies Git commit diffs with Jev into bug fixes, security fixes with CWEs, and change types.
CLIbetaRust