Olympix Benchmarks
We run Olympix against real audits and publish every result
Each benchmark takes protocols professional reviewers have already audited, runs Olympix at the same commit with nobody in the loop, and counts how many of the published findings it reaches on its own. Every run ships with its corpus and commits, so you can check the numbers and see how detection improves from one run to the next.
Why it matters
Audit-level findings, caught during development
Fixed while they're cheapest. An issue caught in development costs an afternoon, before the code is locked in and long before it holds value.
Shorter remediation cycles. Fewer findings when the audit lands means fewer rounds of fixes and re-review.
Auditor time where it counts. Reviewers spend their hours on the work only auditors can do, instead of rediscovering what a machine can find.
Cleaner audit reports. A report that tells your board, partners and users the code arrived in good shape.
Olympix vs. the Audit
Olympix ran BugPoCer across fifteen EVM protocols that audit firms and bug bounty programs had already reviewed, and with nobody in the loop it found 128 of the 188 high and medium severity issues those reviews published.
Olympix found 128 of the 188 issues professional reviewers published.
High and medium severity findings from published audit and bug bounty reports across fifteen EVM protocols. Olympix ran at the same commits, with no human input.
of high and medium severity findings reproduced automatically
protocols, each already reviewed by a firm or a bug bounty program
of wall clock for the whole corpus
analyst hours
Protocol by protocol
Bar length is the number of published findings, the fill is how many Olympix found.
Selected protocol
revert-lend
Method
How every benchmark runs
The method stays the same from run to run, which is what makes one result comparable to the next. The corpus is picked for spread across protocol types, never for difficulty or for where Olympix performs well.
Start from a published review
Every protocol has already been through a public audit or bug bounty program with a published report. Ground truth is the high and medium severity findings in those reports, and none of them come from us.
Run at the audit commit
Olympix runs on the exact commit each review was performed against, with no report, no hints and no human in the loop.
Count independent matches only
A finding counts when Olympix surfaces the issue the reviewers reported on its own. Reviewers and commits are published with every run so anyone can check the arithmetic.
Olympix and the audit
Two different jobs, and you need both
The differences are structural. Each one covers a failure mode the other can't, which is why teams run Olympix first and keep the audit.
Beyond the overlap
Audited code still gets exploited
An audit is the strongest control most protocols buy, and it's bounded by design to an agreed scope, one commit and a set number of senior reviewer hours. In a separate study we took every 2025 EVM hack with a smart contract issue at its root cause, fifty incidents in total, and assessed each one against Olympix with no additional intervention.
Read the 2025 exploit analysis →2025 EVM hacks Olympix would have prevented at the time of the study, and updates since then cover the fiftieth
of losses in that scope preventable at the code level, based on the backtest
Archive
Every benchmark, on record
Each run is published with its corpus, commits and method, so the history shows how Olympix detection moves over time. Corpora can differ between runs, so compare match rates with the corpus in view.
Your codebase
Benchmark Olympix against your own last audit
Send us a repo that's already been audited, and we'll run Olympix at the same commit and show you what comes back.