Paste into your AI agent inside the project you want reviewed. This is a prompt, not a shell command.
For Ethereum & Solidity
Solidity reviews,
with your AI agent.
Review your contracts, propose focused fixes,
and keep the evidence behind each change.
Open source. No custom model or API key needed for reviews.
One prompt. Your own agent.
Open your project in your agent. Paste the prompt. It handles setup.
Prefer to set it up yourself?
Manual setup
git clone https://github.com/Shawnchee/hindsight.git
cd hindsight
python3 -I tests/test_skill.pyOpen the Hindsight folder in your agent.
Your agent reviews the code. Hindsight checks source references and report structure.
A valid report is not proof that a contract is safe.
Start with what you need.
Review your contracts
Paste one prompt into your agent. Get source-backed findings and proposed fixes.
Study past incidents
Explore the catalog and research records, or use the metadata in your own tools.
Add evidence
Submit a public report or improve an incident record through a GitHub PR.
Reviews inspect your code; the agent does not automatically search the incident catalog.
Hundreds of incidents. Evidence you can inspect.
Ethereum incident metadata, source references and research records.
- Reported incidents
- 357
- From 2025–2026
- 117
- Deeper research cases
- 10
Browse all 357 catalog entries, including 58 from 2025 and 59 from 2026. The separate research snapshot covers 10 cases and 55 components; its labels remain unverified (0 human-verified). Counts overlap.
Browse all 357 incidentsSources: DeFiHackLabs leads, protocol/researcher reports, Sourcify/Etherscan, and historical Ethereum reads.
Catalog pinned to 21 October 2026. Reported incident dates are not verified first-disclosure dates; this is not a complete live list.
Incidents in the catalog
Reported entries by year · 357 total
Coverage varies by year. 2026 is partial, through 21 October. Counts are not a measure of industry-wide hack frequency.
Reported loss examples
Highest to lowest · five selected cases · reported USD
Not total losses. Figures may span chains and differ in treatment of recoveries; they are not independently reconciled.
Chart sources & amounts
Counts come from the pinned Ethereum catalog. Losses are selected explicit USD claims from its upstream metadata; no token prices or exchange rates were inferred. Balancer’s amount includes multiple chains. Catalog membership and chain classifications remain provisional.
| Source record | Incident date | Reported USD |
|---|---|---|
| BalancerV2 | 2025-11-03 | $120,000,000 |
| Corkprotocol | 2025-05-28 | $12,000,000 |
| ResupplyFi | 2025-06-26 | $9,600,000 |
| yETH | 2025-12-01 | $9,000,000 |
| Makina | 2026-01-20 | $5,100,000 |
2026 catalog examples
Showing 3 of 59 reported entries from 2026. This is a preview; use the full catalog for every record.
| Reported incident | Data status | Evidence |
|---|---|---|
| BiFi | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| KolanHook | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| X7Finance | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
2025 catalog examples
Showing 3 of 58 reported entries from 2025. This is a preview; use the full catalog for every record.
| Reported incident | Data status | Evidence |
|---|---|---|
| yETH | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| DRLVaultV3 | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| BalancerV2 | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
Enriched snapshot v0.2.0
Three older research examples. Components include proxies and dependencies, not separate vulnerable contracts.
| Incident | Source coverage | Evidence |
|---|---|---|
| Cheese Bank | Proposed defect file present | Report Record |
| xToken xSNX August exploit | Proposed defect file present | Report Record |
| bZx first February 2020 exploit | Defect source still missing | Report Record |
All labels are AI-proposed and unresolved. A recovered file does not establish complete incident coverage. None of these enriched records is approved for training or evaluation.
Where the data comes from
- Incident leads
- DeFiHackLabs catalog (Apache-2.0), parsed from README entries and header identifiers, plus protocol post-mortems and original security research.
- Source & chain evidence
- Sourcify, Etherscan, and historical Ethereum RPC reads. Records retain addresses, transaction identifiers and source hashes.
- New reports
- RSS and optional Serper find unverified leads. They stay in a separate review queue; they do not automatically enter this snapshot.
- What we publish
- Metadata, evidence links and our own summaries. No contract source, PoCs or copied article/post bodies.
- What remains unknown
- Earliest disclosure, exploit-family grouping, source availability at incident time and human adjudication. Publication dates and source matches do not resolve these gaps.
Inspect an actual record’s fields
This is a shortened Cheese Bank record, not a full training example.
{
"incident_id": "20201106_CheeseBank",
"label_status": "proposed",
"human_verified": false,
"first_seen_at": null,
"family_id": null,
"training_eligible": false,
"evaluation_eligible": false
}The preview separates six recent catalog entries from three enriched records, with evidence links, source fingerprints and coverage gaps. It is generated from the versioned snapshot; it includes no source code.