Soly - AI Coding Assistant

Demo

About

The problem it solves Smart contracts on Ethereum are opaque by default. Even when source code is verified on Sourcify, developers, auditors, and users have no easy way to understand what a contract does, how it's structured, or what risks it carries — without reading thousands of lines of Solidity manually. **Soly / Sourcify Contract Analyzer** solves this by turning Sourcify-verified contract data into structured, human-readable intelligence: - **Proxy resolution** — automatically detects EIP-1967, UUPS, Gnosis Safe, Diamond, and other proxy patterns and follows the implementation - **Storage layout summary** — maps on-chain state variables slot by slot from verified metadata - **Dependency audit** — identifies OpenZeppelin, Uniswap, Aave, Chainlink and other library families used in the contract - **ABI + signature fingerprinting** — extracts all function, event, and error signatures from verified sources - **Audio transcript** — generates a spoken-style narration of the contract analysis, making it accessible without reading code - **Multi-deployment target** — works as a Python CLI, a Django + Express full-stack app, and a Cloudflare Worker (zero infra, edge-deployed) The tool uses **only Sourcify-verified data** — no off-chain assumptions, no LLM hallucination. Every claim is grounded in the verified source bundle. Useful for: developers auditing unfamiliar contracts, wallets showing users what they're signing, and AI agents enriching on-chain context.

How it's made

Challenges we ran into **1. Sourcify API field selection** The `/v2/contract` endpoint supports a `fields` query parameter, but not all field names are valid. Passing `match` or `creationMatch` directly returns a 400 error. We had to discover the correct field names by reading the Swagger spec carefully and testing iteratively before landing on `fields=all` as the safe default. **2. Cloudflare Worker template string nesting** The Worker serves both server-side logic and the full HTML UI in a single JS file. Nesting template literals inside the outer backtick-delimited HTML string caused syntax errors. We resolved this by converting inner template expressions to string concatenation, keeping the outer template clean. **3. XSS from Sourcify data** Sourcify returns contract metadata fields that could contain arbitrary strings. When we rendered these values into `innerHTML` in the Worker UI, we introduced a potential XSS vector. We fixed this by adding an `esc()` helper that uses DOM `textContent` for safe HTML-escaping before any insertion.