Paste into your AI agent inside the project you want reviewed. This is a prompt, not a shell command.
For Ethereum & Solidity
Solidity reviews,
with your AI agent.
Review your contracts, propose focused fixes,
and keep the evidence behind each change.
No custom model. No API key needed for reviews.
One prompt. Your own agent.
Open your project in your agent. Paste the prompt. It handles setup.
Prefer to set it up yourself?
Manual setup
git clone https://github.com/Shawnchee/hindsight.git
cd hindsight
python3 -I tests/test_skill.pyOpen the Hindsight folder in your agent.
Your agent reviews the code. Hindsight checks source references and report structure.
A valid report is not proof that a contract is safe.
See what’s in the dataset.
357 Ethereum catalog entries · 2025: 58 · 2026: 59
The catalog includes newer incidents. The separate enriched snapshot (v0.2.0) covers 10 older incidents and 55 components, with 0 human-verified labels.
Sources: DeFiHackLabs leads, protocol/researcher reports, Sourcify/Etherscan, and historical Ethereum reads.
Catalog pinned to 21 October 2026. Reported incident dates are not verified first-disclosure dates; this is not a complete live list.
Incidents in the catalog
Reported entries by year · 357 total
Coverage varies by year. 2026 is partial, through 21 October. Counts are not a measure of industry-wide hack frequency.
Reported loss examples
Highest to lowest · five selected cases · reported USD
Not total losses. Figures may span chains and differ in treatment of recoveries; they are not independently reconciled.
Chart sources & amounts
Counts come from the pinned Ethereum catalog. Losses are selected explicit USD claims from its upstream metadata; no token prices or exchange rates were inferred. Balancer’s amount includes multiple chains. Catalog membership and chain classifications remain provisional.
| Source record | Incident date | Reported USD |
|---|---|---|
| BalancerV2 | 2025-11-03 | $120,000,000 |
| Corkprotocol | 2025-05-28 | $12,000,000 |
| ResupplyFi | 2025-06-26 | $9,600,000 |
| yETH | 2025-12-01 | $9,000,000 |
| Makina | 2026-01-20 | $5,100,000 |
2026 catalog examples
59 Ethereum entries dated 2026 in the pinned catalog. These are reported entries, not 59 independently verified hacks.
| Reported incident | Data status | Evidence |
|---|---|---|
| BiFi | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| KolanHook | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| X7Finance | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
2025 catalog examples
58 Ethereum entries dated 2025 in the pinned catalog. These are reported entries, not 58 independently verified hacks.
| Reported incident | Data status | Evidence |
|---|---|---|
| yETH | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| DRLVaultV3 | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| BalancerV2 | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
Enriched snapshot v0.2.0
Three older research examples. Components include proxies and dependencies, not separate vulnerable contracts.
| Incident | Source coverage | Evidence |
|---|---|---|
| Cheese Bank | Proposed defect file present | Report Record |
| xToken xSNX August exploit | Proposed defect file present | Report Record |
| bZx first February 2020 exploit | Defect source still missing | Report Record |
All labels are AI-proposed and unresolved. A recovered file does not establish complete incident coverage. None of these enriched records is approved for training or evaluation.
Where the data comes from
- Incident leads
- DeFiHackLabs catalog (Apache-2.0), parsed from README entries and header identifiers, plus protocol post-mortems and original security research.
- Source & chain evidence
- Sourcify, Etherscan, and historical Ethereum RPC reads. Records retain addresses, transaction identifiers and source hashes.
- New reports
- RSS and optional Serper find unverified leads. They stay in a separate review queue; they do not automatically enter this snapshot.
- What we publish
- Metadata, evidence links and our own summaries. No contract source, PoCs or copied article/post bodies.
- What remains unknown
- Earliest disclosure, exploit-family grouping, source availability at incident time and human adjudication. Publication dates and source matches do not resolve these gaps.
Inspect an actual record’s fields
This is a shortened Cheese Bank record, not a full training example.
{
"incident_id": "20201106_CheeseBank",
"label_status": "proposed",
"human_verified": false,
"first_seen_at": null,
"family_id": null,
"training_eligible": false,
"evaluation_eligible": false
}The preview separates six recent catalog entries from three enriched records, with evidence links, source fingerprints and coverage gaps. It is generated from the versioned snapshot; it includes no source code.