Paste into your AI agent inside the project you want reviewed. This is a prompt, not a shell command.
For Ethereum & Solidity
Solidity reviews,
with your AI agent.
Review your contracts, propose focused fixes,
and keep the evidence behind each change.
Open source. Hindsight requires no additional model or API key.
One prompt. Your own agent.
Open your project in your agent. Paste the prompt. It handles setup.
Prefer to set it up yourself?
Manual setup
git clone https://github.com/Shawnchee/hindsight.git
cd hindsight
python3 -I tests/test_skill.pyClone into a separate tools folder. After this check, return to your Solidity project, open that project in your agent and paste the prompt above.
Your agent reviews the code. Hindsight checks source references and report structure.
A valid report is not proof that a contract is safe.
What does a finding look like?
Illustrative example only — not a scan result.
- Evidence
Vault.sol:42—setFee()changes the fee without checking the caller.- Impact
- Any caller could change fees intended to be controlled by an administrator.
- Proposed fix
- Restrict the setter to the intended role and enforce the documented fee limit.
- Still to check
- Confirm the intended role and deployed configuration. Runtime tests have not run.
Start with what you need.
Review your contracts
Paste one prompt into your agent. Get source-backed findings and proposed fixes.
Study past incidents
Explore the catalog and research records, or use the metadata in your own tools.
Add evidence
Submit a public report or improve an incident record through a GitHub PR.
Reviews inspect your code; the agent does not automatically search the incident catalog.
Hundreds of incidents. Evidence you can inspect.
Ethereum incident metadata, source references and research records.
- Reported incidents
- 357
- From 2025–2026
- 117
- Deeper research cases
- 10
Browse all 357 catalog entries, including 58 from 2025 and 59 from 2026. The separate research snapshot covers 10 cases and 55 components; its labels remain unverified (0 human-verified). Counts overlap.
Browse all 357 incidentsSources: DeFiHackLabs leads, protocol/researcher reports, Sourcify/Etherscan, and historical Ethereum reads.
Catalog pinned to 21 October 2026. Reported incident dates are not verified first-disclosure dates; this is not a complete live list.
Incidents in the catalog
Reported entries by year · 357 total
Coverage varies by year. 2026 is partial, through 21 October. Counts are not a measure of industry-wide hack frequency.
Reported loss examples
Highest to lowest · five selected cases · reported USD
Not total losses. Balancer’s $120M includes multiple chains. These are five selected examples; recoveries are not independently reconciled.
Chart sources & amounts
Counts come from the pinned Ethereum catalog. Losses are selected explicit USD claims from its upstream metadata; no token prices or exchange rates were inferred. Balancer’s amount includes multiple chains. Catalog membership and chain classifications remain provisional.
| Source record | Incident date | Reported USD |
|---|---|---|
| BalancerV2 | 2025-11-03 | $120,000,000 |
| Corkprotocol | 2025-05-28 | $12,000,000 |
| ResupplyFi | 2025-06-26 | $9,600,000 |
| yETH | 2025-12-01 | $9,000,000 |
| Makina | 2026-01-20 | $5,100,000 |
2026 catalog examples
Showing 3 of 59 reported entries from 2026. This is a preview; use the full catalog for every record.
| Reported incident | Data status | Evidence |
|---|---|---|
| BiFi | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| KolanHook | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| X7Finance | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
2025 catalog examples
Showing 3 of 58 reported entries from 2025. This is a preview; use the full catalog for every record.
| Reported incident | Data status | Evidence |
|---|---|---|
| yETH | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| DRLVaultV3 | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
| BalancerV2 | Catalog entry Coverage not assessed here | Record ↗Upstream ↗ |
Enriched snapshot v0.2.0
Three older research examples. Components include proxies and dependencies, not separate vulnerable contracts.
| Incident | Source coverage | Evidence |
|---|---|---|
| Cheese Bank | Proposed defect file present | Report Record |
| xToken xSNX August exploit | Proposed defect file present | Report Record |
| bZx first February 2020 exploit | Defect source still missing | Report Record |
All labels are AI-proposed and unresolved. A recovered file does not establish complete incident coverage. None of these enriched records is approved for training or evaluation.
Where the data comes from
- Incident leads
- DeFiHackLabs catalog (Apache-2.0), parsed from README entries and header identifiers, plus protocol post-mortems and original security research.
- Source & chain evidence
- Sourcify, Etherscan, and historical Ethereum RPC reads. Records retain addresses, transaction identifiers and source hashes.
- New reports
- RSS and optional Serper find unverified leads. They stay in a separate review queue; they do not automatically enter this snapshot.
- What we publish
- Metadata, evidence links and our own summaries. No contract source, PoCs or copied article/post bodies.
- What remains unknown
- Earliest disclosure, exploit-family grouping, source availability at incident time and human adjudication. Publication dates and source matches do not resolve these gaps.
Inspect an actual record’s fields
This is a shortened Cheese Bank record, not a full training example.
{
"incident_id": "20201106_CheeseBank",
"label_status": "proposed",
"human_verified": false,
"first_seen_at": null,
"family_id": null,
"training_eligible": false,
"evaluation_eligible": false
}The preview separates six recent catalog entries from three enriched records, with evidence links, source fingerprints and coverage gaps. It is generated from the versioned snapshot; it includes no source code.