Achieve complete coverage in smart contract security

Thornmail provides complete security coverage when inputs are generated correctly. Our AI assistant helps you create the perfect input to ensure comprehensive vulnerability detection and zero blind spots.

Join waitlist

Let Thornmail hack.

Thornmail automatically analyzes your entire protocol

Seamless Integration

Thornmail works with existing GitHub CI workflows and provides a powerful CLI tool for command-line execution, making it easy to integrate into your development process.

External Contract Analysis

Analyzes external contract interactions and how they can be used to create attack vectors on your smart contracts through exploitation techniques.

Vector Report

Returns detailed attack vectors that can be used to hack your smart contract, providing actionable exploitation paths instead of traditional audit reports for deeper security understanding.

No Source Code Needed

Thornmail works with EVM bytecode only, so no source code is required. You can upload your Solidity source code to receive more detailed fix recommendations.

Up to 100% Coverage

Thornmail analyzes every possible flow that can be generated under the user-defined environment, providing up to 100% coverage in properly designed environments.

Code Verification

The Thornmail app verifies that bytecode has been analyzed and can publish verification results, providing transparency and trust in the security analysis.

Automated. Integrable. AI-assisted.
And yes — automated again.

Thornmail automates the entire audit process and can provide up to 100% coverage. Plus, it's fully integrable with development flows.

Intercontract Interaction Checker

Thornmail doesn't just analyze your contract for known issues. It uses external contracts in its environment to create complex attack vectors (flash loans, oracle manipulation, etc.).

Your Contract
Manipulable Oracle
Attack Vector Solved
Interblock price manipulation allows successful bypass of condition at flow[:532].
Attack Vector Solved
Flash loan can be used to bypass condition at flow[:23].

Terminal Execution

You can connect your Thornmail account through Thornmail CLI. Thornmail CLI allows you to send analysis requests from the command line.

>
thornmail --code 0x604060... --output o.json --input i.json
Analyze request sent...
Waiting for Thornmail servers to complete review...
Analyze completed.
2 Critical / 1 Medium issues found. Check output file

AI Chat Assistant

Configuring Thornmail inputs can be time-consuming and confusing. The AI Assistant will design the proper input file for your protocol.

Prepare Thornmail input for an AMM on BASE
Preparing Thornmail inputs...
Analyzing codebase:
• Creating input file
• Designing edge states
• Defining environment
Type your protocol details...

Flow Analysis & Attack Vectors

Thornmail analyzes every flow that your contract can execute. It uses these flows with other contract flows in your environment to create attack vectors. If the environment is well designed, it provides 100% coverage.

Analyzing contract flows...
RUNNING
Flow Coverage Analysis100%
• 38756 execution flows identified
Generating Attack Vectors
Combining flow[:23] → flow[:156] → external[:oracle] creates potential price manipulation vector through cross-contract interaction.
Flow-based Attack
Risk: Medium

GitHub CI Integration

Seamlessly integrate Thornmail into your GitHub workflows with automated security audits on every pull request and commit.

thornmail/security-audit
feat: add security scanning workflow
Running
Initializing environment
Decoding contracts
Creating possible flows
Initiating states
Security vulnerability scanRunning...
Compliance checkPending
Triggered by @developer • Pull Request #247

Ready to secure
the infrastructure of the future?

Thornmail is currently under development. Join our waitlist to be among the first to experience next-generation automated security auditing.

Join waitlist

For any inquiries, feel free to reach out to us:

[email protected]