local fork
sample- pinned block
- 21 004 117
- exploit
- reproduced
- foundry test
- passes
get fork-proven pocs before attackers do.
sentra watches the contracts in your bounty scope, re-checks every upgrade, and only reports what it can replay on a fork pinned to a block.
watching proxy upgrades
passes
fork-proven
reentrancy in vault.withdraw()
block 21,004,117 · pinnedsample
-
scope, fail-closed. out of scope means zero downstream calls.
-
fork, block-pinned. proofs of concept run on local forks or testnets, never against a live network.
-
poc, forge test passes. what survives becomes a foundry test that passes on a pinned fork.
-
human approval. nothing reaches a bounty platform without a human approval, signed and logged.
works with
drag the row, or use the left and right arrow keys, to move it.
the gap
upgrades ship monthly. audits come yearly.
the months in between are where protocols get drained, and nobody is paid to watch them.
-
point-in-time
the audit ages the day you upgrade
a proxy points at new code on a tuesday. the report you paid for describes last quarter’s contracts.
-
noise, no proof
scanners send alerts, not answers
pattern matches land in a channel nobody triages. none of them come with a way to prove they matter.
-
no poc, no payout
a report without replay gets closed
triagers ask for a working proof of concept. a pdf with a hunch in it is not one.
sentra does not replace your audit. it watches the months between them.
no fork, no finding.
mainnet
read-only- transactions sent
- 0
- state
- untouched
so nobody gets drained, the fork breaks first.
how it works
connect scope. sleep. wake up to proof.
three steps on your side. the nine-stage pipeline does the rest.
sample: a program url resolves into scope classes.
01connect scope
paste your bounty program url or a list of contracts.
- every address is resolved: in scope, own asset, test fixture, or out
- out of scope means zero downstream calls
- a newly found asset is flagged, never hunted, until you widen scope
sample: the read-only watcher reads every new block; one proxy upgrade raises an alert.
02watch 24/7
read-only watchers follow upgrades, permissions and scope changes.
- proxy changes resolve to the new implementation’s bytecode hash
- each material change queues a severity check and a static pass
- rpc spend is metered per workspace, with a hard cap
sample: a fork test runs on a pinned block and passes.
03get fork-proven pocs
what survives becomes a foundry test that passes on a pinned fork.
- a proof report with the evidence bundle attached
- one-click replay from the bundle
- a human approves before anything leaves the workspace
one upgrade night
same minute, two sides of the table.
the team ships a patch and goes to bed. this is what sentra does with the same hours.
your team:a proxy upgrade confirms on ethereum.
sentra:alert fires. scope diff shows the old and new implementation hash. checks queued.
your team:everyone assumes it was a minor patch.
sentra:severity check says proceed, with its reason. static diff linked. fork pinned to a block.
your team:no user impact yet.
sentra:the foundry poc passes 2 of 2. evidence bundle stored. a draft proof report appears.
your team:standup opens the overview.
sentra:the finding waits in “awaiting approval”, replay button next to approve and reject.
your team:the lead approves. the fix merges.
sentra:replay against the fix fails, as it should. regression green. digest sent.
sample · test fixture, times in utc
the pipeline
nine stages, cheapest first.
every hypothesis enters at the top. most die early and cheap. the order never changes.
- 01 / 09
stage 01:scope gate
is the target in scope? only in_scope_bounty, own_asset or test_fixture go on. anything else stops with zero downstream calls.
kills out of scope - 02 / 09
stage 02:pre-filter
cheap checks before any real work, so the expensive stages only see candidates worth their cost.
kills excluded or not worth it - 03 / 09
stage 03:novelty
already reported or audited? queries use the target’s public identity, never the hypothesis.
kills known issue - 04 / 09
stage 04:static
slither plus a targeted read of the code paths the hypothesis depends on.
kills no reachable path - 05 / 09
stage 05:poc, block-pinned
a severity and expected-value check first, then a foundry test that must pass on a local fork pinned to a block. no fork, no finding.
kills does not reproduce local fork, pinned block - 06 / 09
stage 06:proof scorecard
scope, novelty, a replayable poc and program-scaled severity. one failed line sends it back to draft.
kills severity not measured - 07 / 09
stage 07:re-confirm novelty
checked again right before the write-up. someone may have filed it in the meantime.
kills filed meanwhile - 08 / 09
stage 08:human approval
a lead researcher signs off. recorded, never implied.
kills rejected - 09 / 09
stage 09:submit
through the program’s own disclosure channel. never automatic.
the only way out - after all nine no fork, no finding.
passes.
only a hypothesis that survives every stage becomes a report, and a person signs it before it leaves.
works with
built on tools auditors already trust.
open tooling for the analysis, a local fork for the proof, and the program’s own platform for the report.
built on analysis, fork tests and solana programs
python
rust
foundry
slither
anchor
chains evm and solana, read-only
ethereum
solana
where programs live reports go through the program’s own channel
immunefi
code4rena
sherlock
cantina
in the pipeline
- 04 static
- 05 poc, block-pinned
- 09 submit
product tour
one workspace. a view for every role.
devs see scope and alerts, researchers see hunts, the lead sees what needs a signature.
sentra sample data
are we safe right now?
fleet health, active hunts and spend, on one screen.
| signal | now | status |
|---|---|---|
| scopes watched | 3 | live |
| upgrades pending review | 1 | queued |
| active hunts | 2 | running |
| proof drafts open | 1 | awaiting approval |
| hypotheses killed this week | 7 | logged |
| rpc spend | 12% of cap | under cap |
01 · scope gate 02 · pre-filter 03 · novelty 04 · static 05 · poc, block-pinned 06 · proof scorecard 07 · re-confirm novelty 08 · human approval 09 · submit
05 · poc, block-pinned 06 · proof scorecard 07 · re-confirm novelty 08 · human approval 09 · submit everything else it watches
the rest of the coverage.
small, boring checks that catch the changes people miss.
scope sync
your program’s scope, mirrored and diffed, so new assets never slip in unseen.
proxy watch
implementation changes resolved to bytecode hashes and the block they landed in.
permission changes
owner, admin and role moves, with who did it and when.
tvl anomalies
sudden moves flagged and explained, or escalated.
regression suite
every proven poc is replayed against your fixes, so a closed bug stays closed.
webhooks
digests and alerts to slack or your own endpoint.
platform-ready export
markdown proof, json evidence and a draft in the shape triagers expect.
signed audit trail
every approval and rejection logged with who signed it.
kills
most hypotheses die here. that’s the feature.
the hypotheses below are made up; every kill reason is one the pipeline really applies. a fast kill, written down with its reason, saves the week a wrong hypothesis costs.
6 of 6 killed
- h1 rounding in withdraw() drains the vault killedknown issue: the team’s own docs describe it
- h2 the pause can be bypassed killedno unwilling victim: informational at best
- h3 the oracle rate can be pushed killednothing permissionless consumes that rate
- h4 an admin can sweep user funds killedprivileged role: excluded by the program
- h5 signatures replay across chains killedaudited twice already on that path
- h6 fee-on-transfer breaks accounting killedbelow the program’s severity floor
proof
what survives comes with a receipt.
every finding passes the same five lines before it leaves draft. miss one and it goes back.
- 01 in scope, by a fail-closed gate
- 02 novel, checked twice
- 03 replayable: a forge test on a pinned fork
- 04 severity scaled to the program’s own table
- 05 approved by a human, on record
sentra · proof v0.2 sample · test fixture
- finding
- f-0001
- target
- test_fixture/vuln_vault
- scope
- test_fixture
- novelty
- re-confirmed
- fork
- block 19,000,000 · pinned
- forge
- test_exploit() passes
- replay
- 1/1 from bundle
- severity
- high · program-scaled
- evidence
- bundle sha256 · attached
- approval
- awaiting a human
- export
- markdown + json + draft
- bundle
- sha256 4be1 9c07 e2a1 77d0
never auto-submitted. a human signs every export.
approve pull to tear
how it compares
a different job, not a better audit.
scanners, audits and contests all earn their place. here is where each one stops.
| scanner | audit | contest or bounty | sentra | |
|---|---|---|---|---|
| when it runs | all the time(strong) | once, before launch(weak) | a fixed window(partial) | on every material change(strong) |
| what you get | alerts to triage(weak) | a written report(partial) | submissions to triage(partial) | a passing forge test(strong) |
| replayable proof | rarely(weak) | sometimes(partial) | depends on the submitter(partial) | always, or no finding(strong) |
| depth of human review | none(weak) | deep, line by line(strong) | many eyes, briefly(strong) | targeted; a human signs off(partial) |
| covers upgrades after launch | yes, shallowly(partial) | not until the next one(weak) | only while it runs(weak) | yes, each one(strong) |
| what dead ends cost you | your triage time(weak) | nothing, but you never see them(partial) | duplicates and invalids(weak) | a logged kill with its reason(strong) |
use them together: audit before launch, sentra between audits, a bounty for everything else.
when it runs
- scanner
- all the time(strong)
- audit
- once, before launch(weak)
- contest or bounty
- a fixed window(partial)
- sentra
- on every material change(strong)
what you get
- scanner
- alerts to triage(weak)
- audit
- a written report(partial)
- contest or bounty
- submissions to triage(partial)
- sentra
- a passing forge test(strong)
replayable proof
- scanner
- rarely(weak)
- audit
- sometimes(partial)
- contest or bounty
- depends on the submitter(partial)
- sentra
- always, or no finding(strong)
depth of human review
- scanner
- none(weak)
- audit
- deep, line by line(strong)
- contest or bounty
- many eyes, briefly(strong)
- sentra
- targeted; a human signs off(partial)
covers upgrades after launch
- scanner
- yes, shallowly(partial)
- audit
- not until the next one(weak)
- contest or bounty
- only while it runs(weak)
- sentra
- yes, each one(strong)
what dead ends cost you
- scanner
- your triage time(weak)
- audit
- nothing, but you never see them(partial)
- contest or bounty
- duplicates and invalids(weak)
- sentra
- a logged kill with its reason(strong)
use them together: audit before launch, sentra between audits, a bounty for everything else.
design partners
from first call to first digest.
early access is onboarded by hand. this is the plan for your first month.
01 day 0
intro call
send your program url or a list of contracts. we agree scope and data handling in writing.
02 day 1 target
scope resolved
every address checked and labelled. anything out of scope gets zero calls.
03 under 24 h target
first digest
the read-only watcher is live and your first digest lands in slack or email.
04 weeks 2–3 target
the first upgrade
each material change gets a severity check and a static pass; a poc on a pinned fork when it earns one.
05 week 4
review together
we walk through what was caught and what was killed. you decide whether to go on, or walk away.
guardrails
the lines we never cross.
fail-closed by design: if a check cannot pass, nothing runs.
- 01
fork-only pocs
on-chain access is read-only. proofs of concept run on local forks or testnets, never against a live network.
- 02
no auto-submit
nothing reaches a bounty platform without a human approval, signed and logged.
- 03
no custody
read-only by default. anything more goes through a safe you own, with revocable session keys and caps.
- 04
discovery is not authorization
a newly found asset is flagged, not hunted, until a human widens the scope.
stopout of scope means zero downstream calls.
faq
questions teams ask first.
anything missing? write to us and it ends up here.
no. a scanner hands you alerts to triage. sentra hands you a foundry test that already passes on a fork pinned to a block, plus the evidence to replay it yourself.
no. an audit is a deep, point-in-time review and you should keep it. sentra watches the months between audits, when upgrades ship and nobody is looking.
no. on-chain access is read-only and every proof of concept runs on a local fork or a testnet. the boundary is fail-closed: if a check cannot pass, nothing runs.
a human. sentra drafts the report and the evidence, a lead researcher approves it, and nothing is ever submitted automatically.
findings on your scope are yours. the report, the forge test and the evidence bundle go to your workspace, and you decide what gets filed and where. the exact terms are in the design-partner agreement.
we only need public addresses and your program url. each workspace is kept apart, evidence bundles are stored per workspace, and rpc keys never appear in logs or code. we never hold your funds or your keys.
evm chains first. solana and anchor programs second: we have hunted them, and the tooling there is younger than on evm.
every workspace has a metered rpc budget. you get a warning at 80% and jobs pause at 100%, fail-closed, until you raise the cap. no surprise bills.
then you get the kills: every hypothesis tried and the evidence that ended it. that tells you where audit time is not needed.
the evidence bundle pins the chain, the block and the forge test. replay starts a throwaway fork at that block, runs the test, and shows pass or fail with gas and the state diff. same bundle, same result, and you can run it yourself with foundry.
not today. during early access sentra runs as a hosted service. if self-hosting is a hard requirement, tell us: it shapes what we build next.
early access is onboarded by hand. send your program url or a list of contracts and we set up the watcher with you.
early access
the next upgrade ships soon. be watching when it does.
send a program url or a list of contracts. we set up the watcher with you, by hand.
- read-only on chain
- no auto-submit
- no custody