RiskSearcher

Demo

About

RiskSearcher helps users understand whether a smart contract may be dangerous before they interact with it or put funds at risk. A user simply connects with a passkey, pastes an EVM contract address, selects the chain, and starts a scan. RiskSearcher then investigates the contract and presents an easy-to-understand SAFE, UNSAFE, or THREAT verdict, a risk score, and a clear explanation of what it found. Behind that simple workflow, RiskSearcher checks verified source code or bytecode, suspicious contract permissions and functions, transaction behavior, known scam patterns, and live liquidity activity. It also uses an AI specialist and judge to reason across those signals, helping catch risks that a basic rules engine can miss while still showing the evidence behind the final decision. Users can review their previous scans, inspect individual risk findings, view live Uniswap V3 liquidity evidence powered by The Graph, and re-run analyses when needed. New users can claim a Sybil-resistant 3-scan free trial through World Selfie Check, while additional scan credits can be purchased with USDC on Arc Testnet. Passkey authentication makes access passwordless, and scan credits, payment history, and usage are enforced and recorded by the backend. Before this hackathon, RiskSearcher existed as a local CLI-based analysis engine. During ETHOnline, I turned it into a deployed full-stack product with a real web interface, streamed five-stage analysis, user accounts and scan history, The Graph live-data integration, Circle-powered passkey and wallet infrastructure, Arc USDC payments, World ID-based free-trial protection, and server-enforced access control.

How it's made

RiskSearcher uses a React + Vite frontend deployed on Vercel and a FastAPI backend on Render, with Server-Sent Events streaming analysis progress to the UI. The analysis engine combines Etherscan-verified source code, Alchemy RPC bytecode and transaction data, deterministic Solidity/EVM rules, behavioral transaction analysis, FAISS scam-pattern similarity, and an LLM specialist + judge layer. For live market evidence, The Graph Gateway queries Uniswap V3 liquidity, pool, age, and volume data and feeds that evidence into the AI reasoning pipeline rather than simply displaying it. For user access, Circle Modular Wallets provides WebAuthn/passkey-based ERC-4337 identity, while Circle Developer-Controlled Wallets on Arc Testnet handle real USDC balances and payments. A $5 USDC payment grants 10 scans only after backend confirmation. World Selfie Check is verified server-side and its nullifier is stored in Firestore to enforce one 3-scan free trial per verified human. Firestore also persists entitlements, ledger activity, and scan history, so access control is enforced by the backend rather than trusted frontend state.