Sentinelio

Demo

About

Sentinel is an AI-powered smart contract security scanner built for anyone — not just developers — who wants to know if a smart contract is safe before interacting with it. Users simply paste an Ethereum contract address into the app. Sentinel fetches the contract's publicly verified source code via the Etherscan API, then sends it to Google's Gemini AI with a specialized security-auditing prompt designed to detect common vulnerability classes: reentrancy, integer overflow/underflow, unchecked external calls, access control flaws, front-running risk, and denial-of-service vectors. What makes Sentinel different from existing tools like Slither or Mythril is accessibility and context. Instead of returning dense, developer-only technical output, Sentinel translates every finding into plain-English explanations that a non-technical investor can actually understand — using analogies where helpful. Critically, Sentinel also cross-references each detected vulnerability against a set of well-documented historical exploits (such as The DAO hack of 2016 or the Parity multisig freeze), flagging when a contract's code pattern resembles a real-world incident that cost users millions of dollars. This turns an abstract security score into a concrete, memorable warning. The app requires zero setup — no installing security tooling, no command-line tools, no wallet connection. Users get a color-coded overall risk score, a list of specific issues with severity ratings, and a one-click "Copy Report" feature to share findings. No user data or scan history is stored, keeping the experience private by design. Sentinel was built to make Web3 security literacy accessible to everyday users navigating an ecosystem where scams and exploits remain a major barrier to trust and adoption.

How it's made

Sentinel is built with Next.js 14 using the App Router and TypeScript, styled with Tailwind CSS for a clean, dark themed UI. The entire app is stateless with no database, which keeps the architecture simple and means no user data is ever stored. The core flow works like this: when a user submits a contract address, our Next.js API route first validates the address format, then calls the Etherscan API to fetch that contract's publicly verified Solidity source code. If the contract isn't verified, we return a friendly error rather than a technical one. Once we have the source code, we send it to Google's Gemini API (using the fast, free tier Gemini Flash model) with a carefully engineered system prompt instructing it to act as a smart contract security auditor. The prompt asks Gemini to identify vulnerabilities across categories like reentrancy, integer overflow, unchecked external calls, and access control issues, and to return the findings strictly as structured JSON. A key technical decision was designing the prompt to also cross reference each finding against a list of well known historical exploits, such as The DAO hack and the Parity multisig freeze, so the AI can tell users when a pattern resembles a real world incident, not just abstract terminology. We parse Gemini's JSON response, strip any accidental markdown formatting Gemini sometimes adds despite instructions, and render it into risk score badges, severity coded issue cards, and collapsible technical detail sections on the frontend. One genuinely hacky but practical choice was building this entirely through an AI assisted development workflow using Cursor, since our team had no prior professional coding experience. We wrote detailed, structured prompts describing exact API behavior, UI components, and error states, and let Cursor's AI agent scaffold, implement, debug, and commit the code step by step. We also had to adapt on the fly when a model name for Gemini changed between versions, which the agent caught and corrected automatically after hitting an API error during testing. For deployment, the app is hosted on Vercel, with both the Etherscan and Gemini API keys stored securely as environment variables rather than in code, and explicitly excluded from git via .gitignore to avoid ever exposing credentials publicly.