Smart contract assurance for institutions that must evidence control over on-chain systems: automated analysis, continuous compliance monitoring and reproducible verdicts, deployed inside your environment.
Architecture
Proprietary detection model at the core, with a rules engine applying control frameworks
Coverage
EVM including Hyperledger Besu, Solana, and Move-based chains
Compliance mapping
NIST CSF, ISO 27001, DORA and MiCA, plus your own control framework
Architecture
SCG360 is deployed in a client VPC or on-premises environment. Analysis, models and evidence stay inside that boundary; the Client Focus control plane receives metadata only.
Analysis engines, self-hosted models, contract code and the client control overlay operate within the client environment.
The Client Focus control plane processes only hashes, verdicts and version identifiers, never contract source or bytecode.
Contract source, bytecode and model inference never leave the client boundary.
Scope
One governed service across EVM and non-EVM networks: a proprietary detection model at the core, a rules engine that applies control frameworks, and established engines as supporting layers.
Client Focus's proprietary detection model, in production in C'ROC and fine-tuned on labeled exploit patterns, analyzes contracts across EVM and non-EVM networks, supported by established engines for each chain family. Coverage includes contract vulnerabilities, upgradeable proxy patterns with storage-layout diffing, economic dependencies and governance attack paths.
A customized rules engine captures control definitions as executable rules and applies them during analysis, so findings map directly to NIST CSF, ISO 27001, DORA, MiCA, the OWASP Smart Contract Top 10 and the client's own framework. Changes to implementations, administrators, owners or guardians trigger reassessment.
Models inside the client environment propose business-logic, economic and access-control hypotheses. A hypothesis becomes a finding only on deterministic confirmation. AI drafts exploit scenarios and remediation guidance from confirmed findings, fixed to the analyzed bytecode hash.
REST APIs and CI/CD hooks connect analysis to the release process. Role-based access, an audit trail, portfolio views and exportable reports support engineering, risk and audit teams.
| Chain family | Supporting engines |
|---|---|
| EVM chains and Solidity, including Hyperledger Besu | Slither, Mythril, Foundry, Echidna |
| Solana, Rust and Anchor programs | X-Ray, Sec3 |
| Move-based chains such as Aptos and Sui | Move Prover |
The proprietary detection model runs across all chain families. Formal verification tools can be integrated for critical invariants. Chains in scope for an engagement are agreed and validated before go-live.
Methodology
Oracle and price-manipulation risk spans dependencies and execution paths. SCG360 turns those dependencies into executable properties and keeps model suggestions separate from confirmed evidence.
Trace price feeds, update authority and liquidity sources, and record assumptions about freshness, deviation limits and available liquidity.
The detection model ranks candidate paths against known exploit signatures, including stale prices, thin-liquidity manipulation and cross-contract sequencing.
Each candidate becomes a testable property, such as collateral sufficiency or bounded payout, replayed and fuzzed against a pinned state snapshot.
Only a reproducible invariant violation or rule-backed trace becomes a finding, recorded with the bytecode, state, inputs and tool versions.
Published detection figures for SCG360's contract-analysis scope await independent substantiation against a defined corpus.
Method
Analysis runs continuously across the release and monitoring cycle, producing versioned evidence at each change.
Assurance
Rules determine the conformance verdict. AI informs investigation and explanation; the verdict remains rule-based.
Certificates bind a result to the bytecode hash and pinned engine and ruleset versions, and can be anchored to an on-chain attestation registry where a client requires public verifiability. Model-generated explanations are excluded from the comparison. The certificate attests to the automated analysis performed; network configuration and settlement governance remain the client's responsibility, and the client retains authorship of its control framework.
Due diligence
Technical evaluation and third-party risk review run at the same stage. The six diligence artifacts a reviewer receives are set out in the spec sheet.
Go-live testing uses an agreed corpus of vulnerable and benign contracts with expected verdicts. It reports confirmed detections, misses and false positives, with the critical class reported separately. Published figures follow a defined corpus, measurement date and pinned toolchain.
The detection engine runs inside the client boundary, versioned and tested against a fixed, held-out corpus. Changes carry repeat validation, production monitoring triggers review on drift, and rule-based verdicts remain independent of model output.
A SOC 2 Type II examination and ISO 27001 certification are planned, with status information and control documentation available on request. Client data is segregated by client, encrypted in transit and at rest, and retained on the client's schedule.
Delivery
Client Focus provisions the environment, calibrates the engines and models, connects the compliance loop, and validates the workflow against an agreed benchmark corpus before go-live acceptance.
Scope, supported chains, contract languages, acceptance criteria and service levels are agreed with each client. Client Focus then operates the control plane, maintains the engines and rulesets, and runs the compliance loop under agreed service levels. The client's engineers retain ownership of contract code, release decisions and remediation; named Client Focus operators remain accountable for the accuracy of the evidence.
Operating model
SCG360 supports the contract assurance workflow. C'ROC watches live on-chain activity and manages security events through a separate operational process.
Related
Engineering and integration for systems that will run on public chains.
Security controls and assessment work across digital asset operations.
How Client Focus approaches controls and operational evidence.
Review your contract portfolio, control requirements and deployment boundary with a principal of the firm.
