v0.1.0

Ultrafuzz v0.1.0 is the first public release of the AI-powered orchestrator for smart-contract fuzzing and threat hunting. It brings property specification, threat modeling, parallel investigation, stateful testing, and report generation into one configurable workflow for Solidity and Vyper projects.

• Investigate from multiple angles. Specialized agents examine a protocol through its actors, user flows, properties, and potential failure modes.
• Combine reasoning with execution. Property-guided investigation works alongside dedicated stateful fuzzing for behavior that depends on transaction sequences and changing state.
• Adapt the workflow to your project. Choose an audit profile and models, edit the prompts and workflow graph, and monitor the campaign from the CLI or dashboard.

Features

• [prompts] [topology] Property-guided threat hunting. Build a shared protocol context, derive concrete properties and invariants, and investigate them through parallel specialist strategies. Threat modeling and generated investigation goals draw on the OWASP Smart Contract Security reference material.
• [runtime] Stateful fuzzing. The exhaustive and invariant-only profiles include dedicated invariant campaigns. Generate and run stateful tests, retaining test artifacts, failure reproductions, and available coverage evidence for review.
• [config] Ready-made audit profiles. Start with smoke, low-cost, default, exhaustive, or invariant-only. Adjust concurrency, strategy breadth, retry limits, and time budgets to fit the project.
• [runtime] [modal] Model and execution choice. Use frontier or open-weight models through Claude, Codex, DeepSeek, Kimi, OpenCode, OpenRouter, and Pi adapters. Run locally or use Modal for supported cloud tasks.
• [cli] [dashboard] Campaign visibility and recovery. Follow the workflow graph, node progress, attempts, logs, token usage, and cost estimates. Inspect blockers and use resume, replay, or fork commands to continue or revisit work.
• [artifacts] Reports with explicit coverage. Deduplicate and review findings, then produce agent-written Markdown and JSON reports. Best-effort execution lets independent work continue after ordinary task failures. Successful reporting marks incomplete coverage as PARTIAL; if reporting fails or cannot start, saved results remain available and the report is marked unavailable. Strict completion and report verification are separate options.
• [prompts] [topology] An editable workflow. Prompts, workflow topology, model profiles, and references live in project files. Extend the specialist strategies, change their handoffs, or reuse the prompts in another orchestrator. Generated test files can be reviewed and explicitly copied into the target repository.
• [evals] [evmbench] Evaluation tooling. Use UltrafuzzBench, EVMBench integration, and the focused ScFuzzBench workflow to evaluate campaign variants. Track precision, recall, F1, time, token usage, and cost, with retained run evidence and published benchmark history.

Get started

Read the launch post, follow the first-campaign guide, or explore the prompt catalog.

Run campaigns on disposable, isolated virtual machines. Agents execute commands without permission prompts; review the security guidance before starting.