Overview
Before a smart contract audit can start, someone has to work out how big the job is. Today that takes days: teams book calls with several audit firms, share sensitive code just to get a ballpark figure, and receive quotes that drift as the code changes. Auditors spend hours sizing work they may never win.
Voxen built a "pre-audit" platform for Solana teams that does this in minutes. It reads a repository, measures how complex and risky it is, estimates the audit effort, highlights where the risk is concentrated, and issues a verifiable receipt, without the code ever being exposed.
The challenge
- Sizing is not counting lines. Two codebases of the same length can need very different audit effort depending on structure, dependencies and risk.
- Sensitive code. Teams are reluctant to share unreleased code just to get a quote.
- Solana is different. Generic tools focus on Solidity or on dependency checks, and miss Solana-specific concerns such as upgradeable programs, account constraints and Anchor patterns.
- Trust in the result. A quote is only useful if both sides can be sure it was produced from the exact code being audited.
What Voxen built
Three ways in.
Teams paste a public repository link, connect GitHub to analyse a private repository, or upload a zip file.
Structural analysis of Rust code.
The platform parses the Rust source into a syntax tree and runs a four-layer analysis: structural, systemic, security and economic. It extracts 19 quantitative factors, such as cyclomatic complexity, cross-program invocations and privileged roles, and 5 qualitative factors read from the code, configuration and documentation.
A complexity score and an effort estimate.
The factors are normalised into a complexity score out of 100. A time-complexity model then estimates audit effort in time, team size and cost, as ranges rather than single numbers, for different levels of review.
AI hotspot triage.
GPT-4o reviews the parsed code alongside the measured factors and flags hotspots: high-risk areas, medium-risk issues and recommendations, each pointing to where an auditor should look first.
Encrypted analysis and verifiable receipts.
Analysis runs through Arcium's encrypted computation, so the code stays confidential. Each report is bound to the exact commit analysed, and a proof is recorded on Solana, so anyone can verify that the receipt matches the code.
A forensic tier.
Beyond scoping, a deeper assessment lists individual findings with severity, status and risk score, tracks how quickly they are resolved, and keeps the history in one dashboard.
Designed for an auditor marketplace.
The receipt format was designed to feed a marketplace that matches each project with suitable auditors based on experience and skill, rather than reputation alone.
Engineering approach
The analysis engine is written in Rust for speed and accuracy on Rust code, with NestJS orchestrating jobs and reports. The AI layer only ever sees structured output from the parser, which keeps its findings grounded in the actual code.
Outcome
Solana teams get a scoped, priced, audit-ready report in minutes instead of days, without sharing their code in the clear, and auditors receive work that is already sized.
What it makes possible
Continuous scoring on every commit, so teams can see how changes affect audit effort, and direct matching with auditors from the same receipt.