AIOil Security Shield

Three Cyborgs. One mission:
break your contract before attackers do.

The free check before a $7,000 audit. A human audit of a Solana program starts in the thousands and takes weeks. Before you commit to one, run your Rust/Anchor code through AIOil Security Shield and find out — in about a minute, for free — whether it's ready for one. Up to 3 scans a day, no wallet, no signup.

Paste your program below and our 3 AIOil Cyborgs take it from there — the AIOil Engineer maps the code, the AIOil Hacker hunts for the exploits real attackers use, and the AIOil Reviewer turns their findings into one public Scan Report: severity breakdown, scan ID, timestamp, nothing hidden.

Every scan ends with a downloadable report — the full findings if there's something to fix, or a verifiable "AIOil Scanned" badge for your own site if the run comes back clean. Need to test the deploy too? A paid scan in $AIOIL that comes back clean also unlocks AIOil Devnet, our hosted validator, and adds a deploy-confirmed stamp to the same report.

Post-mortem: we ran this scanner on Wormhole's bridge code as it stood the day before the 2022 hack — it flagged the exact flaw the attacker used →

ENG HACK REV
aioil-shield · live scan

Paste your Rust/Anchor program below and our three Cyborgs take it from there.

  • The Engineer maps the code.
  • The Hacker hunts for flaws, bugs and blind spots.
  • The Reviewer turns it all into a public report, with severity level, scan ID, date and time.

Nothing will be hidden.

Every scan produces a downloadable report: any fixes you need are listed there. If nothing is found, you also get a verifiable "AIOil Scanned" badge to display on your site.

Free: up to 3 scans a day, no wallet needed. The report is public, so anyone you share it with can verify it.

Free — up to 3 scans a day, programs up to 40,000 characters. No wallet, no token, no signup. The report is public and verifiable.

Optional: paid scan in $AIOIL — also unlocks the AIOil Devnet deploy test

Cost: 5,000,000 $AIOIL per scan, paid on Solana mainnet directly to the AIOil treasury. You'll be asked to approve the transfer in your wallet before the scan runs.

  • Pays for the scan — scans without the daily limit.
  • Unlocks the devnet — $5 held raises your limits, staking raises them further.
  • Lights up REFUEL on the Market Hub, with that same stake.
The pipeline

Our 3 AIOil Cyborgs

The order matters: structure has to be mapped before exploits can be hunted, and findings have to be hunted before they can be reviewed. Nothing here is decorative — it's the actual sequence a submission runs through.

01 — AIOIL ENGINEER

Maps the program

Static analysis of the Rust/Anchor source: every instruction, every account constraint, every PDA — turned into a structural map the next agent can attack.

→
02 — AIOIL HACKER

Hunts known exploits

Checks against known Solana failure patterns: missing signer checks, unchecked math, account substitution ("account cosplay"), Token-2022 decimal exploits.

→
03 — AIOIL REVIEWER

Cuts the noise

Drops false positives, ranks what's left by severity (Critical / High / Medium / Low), and formats the public Scan Report — hash, timestamp, agent version.

What you get

One free scan, a real answer

Free, up to 3 scans a day — no subscription, no signup, no partial results. A human audit of a Solana program starts around $7,000 and runs for weeks; this is the fast read you run first, and again after every fix.

Scan · free

Paste your program, get a real answer

A developer pastes Rust/Anchor code and runs the full pipeline for free — the same three agents, no reduced rule set. The output is always a downloadable, public Scan Report: either the vulnerabilities we found, or a verifiable "AIOil Scanned" badge if the run comes back clean.

AIOil Devnet · with a paid scan

Test the real deploy on our validator

A clean paid scan in $AIOil unlocks AIOil Devnet on the spot — our own hosted validator, always on. Deploy the same compiled program, get test SOL instantly, and add a deploy-confirmed stamp to the same report. No install, no second fee.

Open to everyone

AIOil Devnet — a Solana network of its own

The same validator we use to test scanned contracts, open to any developer — no scan, no payment, no account. It is not Solana devnet: it runs its own genesis, so it starts clean, nobody else's traffic slows it down, and your devnet accounts are not here. Free SOL in two seconds and an RPC that answers.

Loading AIOil Devnet…
Open to all

Free

Everyone. No wallet, no account, nothing to sign.

  • 2 SOL every 12 hours
  • 600 RPC calls / minute
  • Limits counted per IP address

Paste an address and go. This is the whole product for most people, and it stays free.

Hold $AIOIL

Holder

Hold $5 worth of $AIOIL in your wallet.

  • 5 SOL every hour
  • 1,200 RPC calls / minute
  • Limits follow your wallet, not your connection

Connect and sign a message — not a transaction: it moves no funds and costs nothing. We read your balance on mainnet and lift your limits for an hour.

Stake $AIOIL

Staker

Stake $AIOIL in the fee-router.

  • 10 SOL every hour
  • 3,000 RPC calls / minute
  • Highest limits on the network

The same active stake that lights up REFUEL on the Market Hub. One stake, two benefits — you don't do it twice.

Program deploys are not part of the public tiers yet. Behind every tier there is one validator we host and monitor — which is also why the limits start conservative and grow with what it can actually take.

Language rules

What we say, and what we never say

An automated scan can reduce risk. It cannot promise safety — and neither can a successful test-deploy. The wording below is a hard rule, not a suggestion — it applies to every report and every Devnet result this tool ever publishes.

"Certificate of Security"
"Scan Report"
"100% secure"
"No known vulnerabilities detected"
"AIOil Certified"
"AIOil Scanned"
— no equivalent —
"Automated multi-agent scan, not a professional human audit. Reduces risk, does not eliminate it." on every report.
"Deploy Verified"
"Deployed on AIOil Devnet"
— no equivalent —
"AIOil Devnet is our own hosted test validator, not Solana mainnet. A successful deploy confirms the binary runs — it is not a security check." on every Devnet result.
One more light

Same traffic lights you already trust in the Market Hub

Scanned tokens don't get a separate rating system — they get the same kind of chip already next to the mint/freeze/LP lights you check. A clean Scan Report lights up "AIOil Scanned"; a successful test-deploy on AIOil Devnet lights up "AIOil Devnet Tested" too — two more real checks, read the same way as the rest.

AIOil
AIOil
$AIOIL
Mint disabled Freeze disabled LP burned AIOil Scanned AIOil Devnet Tested