How Sentinel works

Sentinel is a pre-launch check for smart contracts. You give it Solidity source, a project folder or the address of a verified contract, pay per audit in USDC, and a few minutes later you have a graded report and an attestation NFT on Base Sepolia.

It is not a replacement for a manual audit by people who read your design. It is the check that should run before every token launch and today runs before almost none of them.

One audit, step by step

1. Ingest. Files are normalised (LF line endings, paths sorted) and hashed into a sourceHash. A deployed address is fetched as verified source from Etherscan, or from Blockscout when Etherscan has none.
2. Compile and static analysis. Slither runs with the solc version the pragma asks for. If the code does not compile, the audit stops and shows the compiler error. There is no model-only fallback.
3. Model analysis. Each contract file, together with the Slither results that touch it, goes to the tier's primary model with a structured prompt. Answers must be valid JSON in a fixed schema; a malformed answer is retried once, then that part is marked as not analysed. The report says so; it is never dropped silently.
4. Merge. A model finding and a Slither finding that share a file, overlap within three lines and have compatible categories become one finding marked as confirmed by static analysis.
5. Quorum. Every critical (and in the Full tier every high) is put to two more models from different labs. It stands with two of three votes. A critical that fails is downgraded to high, never deleted.
6. Score, report, receipts. Points are deducted per finding, the grade is set, every model call is signed as a receipt, and the report is written as canonical JSON with its hash and IPFS CID.
7. Attest. The Sentinel attester calls AuditRegistry.record, which checks the grade rule onchain, stores the audit and mints the attestation NFT to the payer.

What you can do with the result

• Open the report at /a/<auditId> and check it in your browser with Verify.
• Put the badge on your site: /badge/<chainId>/<address>.svg.
• Let a launchpad read GET /api/v1/attestations/<chainId>/<address>, or the registry directly.

Where things live