EllipticZero - Source-available local multi-agent engine for smar

项目说明

EllipticZero

<p align="center">
<a href=" alt="CodeQL" src="
<img alt="Python 3.11+" src="
<img alt="Source a: FSL-1.1-ALv2" src="
<img alt="Domains: smart contracts and ECC" src="
<img alt="Local first reproducible e" src="
</p>

<p align="right"><a href="README.ru.md">Русская версия</a></p>

EllipticZero Research Lab is an independent source-a project by
ECD5A for scoped smart-contract security reviews and defensive ECC research.

It is built for researchers, audit teams, and protocol teams that want local
e instead of model-only output.

Simple outside, strict inside: load a contract or choose an ECC target, write the
research idea, let bounded agents select local checks, then review e,
risk lanes, confidence, and follow-up guidance.

<p align="center">
<img src="docs/assets/console-home.png" alt="EllipticZero interactive home screen" width="820">
</p>

<details>
<summary>Session report and export preview</summary>

<p align="center">
<img src="docs/assets/session-report.png" alt="EllipticZero session report summary screen" width="820">
</p>

<p align="center">
<img src="docs/assets/session-report-details.png" alt="EllipticZero session report e and quality sections" width="820">
</p>

<p align="center">
<img src="docs/assets/session-report-tail.png" alt="EllipticZero session report agent and recommendation sections" width="820">
</p>

<p align="center"><em>Report export action</em></p>

<p align="center">
<img src="docs/assets/session-export.png" alt="EllipticZero session export action screen" width="820">
</p>

</details>

E

| Check | result |
| --- | --- |
| Production release gate | v0.1.9: 325 tests, package metadata, and installed-wheel smoke passed |
| Deterministic golden benchmark | 80/80 machine-readable checks passed |
| Targeted external | 5/5 labeled positi; 1/1 synthetic negati clean |
| Delivery checks | Ubuntu, Windows, macOS, Python 3.11/3.14, and CodeQL passed for v0.1.9 |

The targeted subset currently reports 100% recall, 0% miss rate, and 0%
targeted false-positive rate. These figures apply only to fi
SmartBugs cases and one synthetic negati.

Reproduce the case study ·
Review the e scope ·
Open release v0.1.9

What You Get

a local-first workflow for smart-contract audits and defensive ECC research

tool-backed e instead of model-only claims

normalized smart-contract finding records and compact cards with risk, e, line hints, fix direction, and recheck path

scoped smart-contract signals for signature, oracle, upgrade, and token-accounting review lanes

reproducible sessions, traces, manifests, bundles, and replay

e co, toolchain fingerprints, and secret-redacted JSON exports

SARIF review exports with source-line regions when local hints are a

a deterministic benchmark scorecard with detection fixtures and a clean control case

menu-first golden cases, experiment packs, e summaries, baseline comparison, and provider context preview

cautious reports with manual-review boundaries and remediation direction

License TL;DR: Read, e, run locally, and use for research or internal
review under FSL-1.1-ALv2. Building a competing commercial product,
hosted/SaaS service, OEM integration, white-label product, resale package, or
paid security platform around EllipticZero requires a separate commercial
license. Each published becomes Apache-2.0 after two years.

Why EllipticZero

EllipticZero is built for e local research, not unchecked agent
autonomy. The system keeps agent reasoning, local computation, artifacts,
replay, confidence, and manual-review boundaries in one workflow.

Its goal is to help a careful re narrow what should be checked next, what
the local e actually supports, and what still requires human judgment.

E Quickly

If you are re EllipticZero as a researcher, security team, or potential
commercial partner, start with:

E.md for the e path and benchmark scorecard

SECURITY.md for sandbox, provider, artifact, and data-handling

boundaries

examples/golden_cases/README.md for stable

smart-contract and ECC smoke cases

COMMERCIAL_LICENSE.md if your use case in a

product, hosted service, OEM, white-label, resale, or similar commercial path

Detailed Capabilities

orchestrator-centered sessions with Math, Cryptography, Strategy, Hypothesis, Critic, and Report agent roles

smart-contract parser, compile, repo in, protocol-map, re, benchmark, casebook, and finding-card paths

scoped smart-contract review families for access control, upgrade/storage, asset-flow, vault/share, oracle, liquidation, token accounting, signatures, rewards, AMM/liquidity, bridge/custody, staking, treasury, insurance, and related protocol surfaces

repo-aware Solidity compilation and optional Slither, Foundry, and

Echidna adapters; external findings retain source e, while unsafe
Forge test surfaces are reported instead of executed

cached known-case profile matching from allowlisted metadata sources such as SmartBugs and Slither detector families; remote code is not executed

ECC benchmark packs for point anomalies, encoding edges, cur, cur transitions, subgroup/cofactor and twist hygiene, and bounded domain completeness

golden/synthetic cases with expected report shapes for e smart-contract and ECC smoke checks

traces, manifests, bundles, replay, doctor/self-check, e co, toolchain fingerprints, and secret-redacted JSON snapshots

mock by default, plus openai, openrouter, gemini, and anthropic when configured

Quick Start

Requirements:

Python 3.11+

local filesystem access for artifacts

an API key only if you want to mo mock

Install:

Or use:

Linux/macOS:

WSL should use its own en rather than the Windows .venv:

Smart-contract-focused local setup:

Launch the interface:

For no-key e from the console, open E LAB from the
main interactive menu. From there you can run golden cases, choose
experiment packs, inspect project or sa summaries, compare against a
baseline bundle, update known-case metadata, and preview hosted-provider
context before li.

Run the self-check:

Run a safe e case:

Inside the interacti, use F2 or L to switch between EN and RU.

Common Commands

Smart-contract audit from a local file:

Smart-contract audit from inline code:

Smart-contract benchmark pack from a local file:

ECC research session:

Bounded ECC exploratory mode:

Routing o:

Built-in golden e cases:

For the safe e case from Quick Start, expected first-screen anchors
are Repo Triage Snapshot, ECC Triage Snapshot, Remediation Delta Summary,
Finding Cards, E Co, reproducibility outputs, and lower
export-quality notes for toolchain fingerprint and secret redaction.

Additional CLI utilities:

Runtime Notes

Configuration is resolved from defaults, configs/settings.yaml, en , and optional .env.

Supported pro: mock, openai, openrouter, gemini, anthropic.

The default route uses one provider/model for all roles. Per-agent o are optional.

OpenRouter is supported as an OpenAI-compatible hosted path. Direct smoke checks use openrouter/auto unless a model is pinned.

Local tooling can include managed solc, smart-contract checks, optional static analyzers, SymPy, Hypothesis, z3-solver, bounded mutation probes, ECC testbeds, and optional SageMath.

Inputs stay simple: pasted smart-contract code, inline code, local .sol / .vy files, or free-form ECC seeds. Local contract files can derive a bounded repository root automatically.

Reports start with a compact review snapshot, then co repo triage, in, protocol maps, casebook matches, finding cards, review queues, remediation notes, residual-risk lanes, ECC triage, benchmark posture, family co, and comparison/regression notes when local e supports them.

Comparison flags (--compare-session, --compare-manifest, --compare-bundle) attach sa to fresh bounded runs for cautious before/after and regression-oriented notes.

Completed runs can store session JSON, trace JSONL, reproducibility bundles, o.json, comparati, report.md, and review.sarif under artifacts/.

The interacti can export report.md and review.sarif from the session-actions menu without requiring export commands.

Foundry writes build outputs to an isolated temporary directory. Project tests

with FFI, filesystem, RPC, en, signing, or broadcast surfaces are
skipped and reported for manual execution in a trusted en.

Export policy keeps manifest and bundle material inside appro roots, redacts likely secrets, and treats SARIF/finding cards as review items rather than proof.

Unsafe local plugin path layouts are blocked before registry loading. CodeQL and Dependabot workflows support repository hygiene.

See .en for local configuration options.

Project Docs

docs/INDEX.md is the full documentation map.

E.md is the fastest path for re and commercial e.

docs/CASE_STUDY_SMARTBUGS.md shows a reproducible review.

CONTRIBUTING.md explains feedback, issue, and Pull Request paths.

SECURITY.md, REPRODUCIBILITY.md, and REPORT_SPEC.md define the e, safety, and reporting boundaries.

LICENSE_FAQ.md, COMMERCIAL_LICENSE.md, and TRADEMARKS.md define licensing, commercial use, and brand boundaries.

The gate runs lint, tests, the deterministic benchmark scorecard, distribution
metadata checks, and an installed-wheel smoke test.

Feedback And Contributions

Bug reports, bounded feature proposals, questions, and practical feedback are
welcome through GitHub Issues.
Code changes can be submitted through
Pull Requests after re
CONTRIBUTING.md.

Report sensiti only through
private reporting,
not a public issue.

Donate

If EllipticZero is useful to your work, you can support the project here:

Bitcoin (BTC): 1ECDSA1b4d5TcZHtqNpcxmY8pBH1GgHntN

USDT (TRC20): TUF4ihCN75

Responsible Use

Use EllipticZero only for authorized local research. Keep experiments bounded, re, and inspectable.

License

EllipticZero is licensed under FSL-1.1-ALv2.

The public repository is source-a for e, research, internal
use, and other permitted purposes defined by the license.

Each becomes a under Apache License 2.0 on the second
anni of the date that was made a.

If you need rights beyond the public license, including competing commercial
use, hosted or managed service use, OEM, white-label, or resale, see
COMMERCIAL_LICENSE.md.

This repository is public, but current should not be described as
OSI-appro releases.

Branding rights are not granted under the code license. See
TRADEMARKS.md.

Commercial Use

E, research, internal review, and local testing are welcome under the
public license terms.

If your use case in a competing commercial product, commercial hosted
service, OEM distribution, white-label usage, or resale, you should obtain a
separate commercial license.

If you are unsure whether your deployment or product plan crosses that line,
contact before shipping or selling it.

See COMMERCIAL_LICENSE.md for the short policy.

Contact

For commercial licensing, collaboration, and partnership inquiries:

<p>
<a href="mailto:" aria-label="Email"><img alt="Email" height="24" src="
&nbsp;
<a href="" aria-label="://cdn.simpleicons.org/
&nbsp;
<a href=" aria-label="GitHub repository"><picture><source media="(prefers-color-scheme: dark)" srcset=" alt="GitHub repository" height="24" src="
</p>

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Source-available local multi-agent engine for smart-contract security review and defensive ECC research with reproducible evidence. FSL-1.1-ALv2.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。