What we do
Olympix is pre-deployment security infrastructure.
Continuous, automated vulnerability detection that runs while your team builds, not a review at the end.
Latest results
August 2026
Olympix independently surfaced 128 of the 188 issues these audits reported.
128 of 188
issues surfaced (68%)
15 protocols
all previously audited.
~11 hrs
for the whole corpus.
0
analyst hours.
How the benchmark works
The full corpus, protocol by protocol with every commit, is in the report.
01
Start with an audited protocol
A protocol that has already been through a professional audit or a bug bounty program. The findings in their published report are the ground truth. None of them are ours.
02
Run Olympix at the same commit
The exact commit the audit was performed against. No report, no hints, no human in the loop.
03
Count only independent matches
An issue counts only when Olympix surfaces the same thing the audit reported, on its own.
What Olympix is doing while it runs:
It reads the codebase and everything shipped with it to work out how the protocol is supposed to behave.
It infers the invariants the code depends on but never states, then hunts the paths that break them. It is looking for the gap between code that works as written and code that works as intended.
Automated detection vs. a smart contract audit
This benchmark is not an argument for replacing audits. The differences are structural.
Findings a machine can surface should not be discovered during a paid engagement. Senior reviewer hours are the scarcest input in the process, and they are better spent on the second column. The full comparison is in the report.
Every commit and pull request
The whole codebase
Catching what a machine can catch, before anyone is billed
Once, at a point in time
The scope agreed in the engagement
Judgment about what the protocol was meant to do
What this benchmark does not show
It measures overlap with what these audits reported, not what they missed.
It measures a sample of already-audited codebases, not every kind of protocol.
Each run covers a specific configuration of the engine, stated in that run's report.
The full list of limits is in each report.
Benchmark reports
Every run, and the report behind it. Each includes the full corpus, the commits, the method and the limits.
Related Research
2025 EVM Smart Contract Exploit Analysis
Every EVM smart contract exploit of 2025 whose root cause was a flaw in on-chain contract logic, fifty incidents, assessed one by one against Olympix.
Includes the full incident table with dates, techniques and losses, the distribution of vulnerability types, post-mortems of the three largest (Balancer, GMX and Cork), and what we'd recommend for enterprise teams in 2026.
50
in-scope exploits reviewed.
49
preventable before deployment.
$240M
in preventable losses.