Skip to content
ZERO COOL
Request a demo
Offensive security research, automated

Break through the unknown.

Agent swarms at your command. They map your whole system, find the bugs that hide between components and prove each one with a working exploit.

Built by researchers from Trail of Bits, Spearbit, Certora, and Offbeat Security
Request a demoRead a real finding
Trusted by
Case study · Solarity

From first clue to verified fix.

One Critical bug in Solarity's library, traced to its root cause, exploited, fixed and re-checked.

Solarity Solidity LibraryCompleted

dl-solarity/solidity-lib9d18920Findings 2C4H1M6L2IReported Nov 18, 2025

Cartesian Merkle Tree non-membership proofs are not bound to the queried key

C-01SeverityCriticalFix reviewFixed

Root cause

For a non-membership proof, _processProof() hashes nonExistenceKey and never reads proof.key. _verifyProof() only checks that nonExistenceKey is not zero.

contracts/libs/data-structures/CartesianMerkleTree.sol:950-987_processProof()
bytes32 leftHash_ = proof_.siblings[proof_.siblingsLength - 2];bytes32 rightHash_ = proof_.siblings[proof_.siblingsLength - 1]; if (directionBit_) {    (leftHash_, rightHash_) = (rightHash_, leftHash_);} bytes32 computedHash_ = hash3_(    proof_.existence ? proof_.key : proof_.nonExistenceKey,    leftHash_,    rightHash_);

Attack path

  1. Take a valid inclusion proof for any existing key K′.
  2. Set existence to false, nonExistenceKey to K′ and key to the target X. Reuse the siblings and direction bits.
  3. Verification rebuilds the correct root and accepts X as absent.

Impact

Any contract that trusts these proofs can be bypassed: blacklist checks, uniqueness constraints, and every rule that depends on proving a key is absent.

Any codebase. Any layer. Zero Cool's agents hunt for exploitable bugs across your entire stack, from frontend to backend, from TypeScript to C++. See the C++ result

How it works

How a finding is made.

Agents map your system, audit its parts in parallel and disprove every lead until only proven bugs remain.

A glacial terrain under a large pale planet, split into four parts.
  1. Code · specs · docs
  2. Threat model
  3. Navigation map
  4. Memory

  1. Map One map of your code, specs, docs and threat models.

  2. Explore Agent swarms explore every part in parallel.

  3. Cross-examine Agents share context, merge duplicates and disprove each other's leads.

  4. Prove Every lead that survives is proven with a working exploit.

  5. Fix Each finding ships with a fix. The fix review in every audit confirms each bug is closed.

  6. Iterate Each run learns from the last and closes its coverage gaps.

Track record

Judged in public.

Zero Cool competes as zcai against human researchers and other AI tools, and every result links to its public record.

  1. 1stSherlock Audit Engine Ripple XRPL Lending Protocol · Sep 2026
  2. 1stSherlock Audit Engine CRXFX · Sep 2026
  3. 1stHackenProof Rain · Nov 2025
  4. 2ndCantina Mento V3 · Dec 2025

Apparently, we've reached a point of no return where AI audit quality is indistinguishable from a human-made one.

Artem Chystiakov Solarity

  • …due to some medium severity issues we found with a last minute AI audit (h/t @ZeroCool_AI) we decided that the most responsible thing to do is delay, address the findings, and do one more audit.

    scoopy trooples Alchemix

  • They've taken on some of our earliest and most demanding engagements, pushed their system hard, and delivered a strong showing in the results we've seen so far.

    Sherlock Audit Engine

  • Their tool demonstrated a strong understanding of our codebase and its context, delivering relevant and valid findings.

    Tangent Finance Protocol team

  • zero cool helped us a lot with securing blank.build, our launchpad on solana. when you're managing people's money, you really can't afford to mess up. they found a few important bugs we missed, even tho we already had a lot of expertise in solana development and smart contract audits. they also reviewed our changes after the first audit and did a second pass, finding a few more minor issues. really glad we had them helping us. super quick and thorough too.

    Julien CTO, blank.build
Engagement

CLI and pull requests

Use the zerocool CLI from your terminal, coding agent or CI to price and run audits. Request reviews on pull requests. Research session: coming soon.

Use the zerocool CLI from your terminal or coding agent to price an audit, start it, follow it and read findings.

zerocool — ~/your-protocolCLI docs →

zerocool auth login

Open the login link in your browser and approve access.
The new key works after browser approval.
Saved to /home/you/.config/zerocool/credentials.json

zerocool launch --workspace your-org --type scan --scope src

Reserve 420 credits for this Job? [y/N] y
Job 7c1e9a40 queued. Reserved 420 credits.
Follow it: zerocool jobs events 7c1e9a40 --follow

zerocool jobs events 7c1e9a40 --follow

Following Job 7c1e9a40. Polling every 30s, Ctrl-C to stop.
queued
running
completed 3 findings (1 high, 1 medium, 1 low)

zerocool findings list 7c1e9a40

ID SEVERITY DISPOSITION TITLE LOCATIONa3f19c02 high valid withdraw() pays out before it clears the entry src/Vault.sol:118-1315be7d410 medium valid Queue length is unbounded in batchWithdraw() src/Vault.sol:204-219e81c6d3a low valid Paused state is not checked in requestWithdraw() src/Vault.sol:87-96
Team

Built by security researchers.

Years of real-world research at Trail of Bits, Spearbit, Certora and Offbeat Security, built into agents with a hacker's mindset.

  • Portrait of Richie Humphrey

    Richie Humphrey

    Co-founder, Research Lead

    Trail of BitsSpearbitCertoraDeloitteMorgan StanleyOffbeat Security

    LinkedInXGitHub

  • Portrait of Kurt Willis

    Kurt Willis

    Co-founder, Technical Lead

    Trail of BitsSpearbitCertoraFraunhofer MLOffbeat Security

    LinkedInXGitHub

Meet the team
FAQ

Common questions.

Short answers on scope, pricing and what happens to your code.

What is Zero Cool?

Zero Cool is a human + AI offensive security system that finds and proves vulnerabilities in any codebase, from backend to frontend. Teams use it for full audits and on every pull request. How it works

Can AI replace a security audit?

Zero Cool delivers full audits: every finding is proven with an exploit, and every fix is tested again. It also reviews every pull request after the audit, so no change ships unreviewed.

How is Zero Cool different from static analyzers and other AI security tools?

Static analyzers match known patterns, and AI scanners list suspicions. Zero Cool maps the whole system and finds the bugs that hide between components, which no single file shows. Other agents try to disprove every lead, and each one that survives is proven with an exploit test, then re-run against your fix. How it works

How does Zero Cool keep false positives down?

Zero Cool reports a lead only after other agents fail to disprove it from a different part of the system. In the published Solarity review, 7,602 clues became 159 leads and 15 findings. How we reduce false positives

What does a Zero Cool report include?

Each finding in a Zero Cool report has a severity, its root cause in the exact lines, the impact, a recommended fix and an exploit test that proves it. When you push a fix, the agents run the exploit again. Read a published report

Has Zero Cool found real vulnerabilities?

Zero Cool found a Critical proof forgery in Solarity's library, fixed in v3.3.0, and published Highs in ZKsync Airbender and VII Finance. TrustSec credits a Zero Cool audit for a $300k Alchemix bounty. Read the Solarity finding

How does Zero Cool rank in security contests?

Zero Cool competes as zcai in public security contests against human researchers and other AI tools, and has come out first against both. It placed 1st in Sherlock Audit Engine's Ripple XRPL Lending and CRXFX engagements and in HackenProof Rain, 1st among AI auditors in Sherlock Audit Engine's first public engagement, 2nd among AI auditors in Aero and 2nd in Cantina Mento V3. See the track record

How much does a Zero Cool audit cost?

Zero Cool prices each audit in credits from the lines of code in scope; a diff review counts only the changed files. The CLI shows the exact price before you start, without charging. If a service failure stops a paid one-off audit, you choose a free re-run or a refund. Read the CLI docs

Which chains and languages does Zero Cool support?

Zero Cool works on every chain and is not tied to a language or framework: Solidity, Rust, Go, C++, TypeScript and more. Its published findings include Solidity protocols, the ZKsync Airbender prover and Monad's RaptorCast validator networking.

Does Zero Cool keep my code or train on it?

Zero Cool does not keep a complete repository or a standalone copy of your code after an audit. It does not train models across customers on your source code, and does not let its providers train on it, unless you opt in. How we handle your code

Can Zero Cool review every pull request in CI?

Zero Cool runs diff reviews that compare a head commit with a base commit and check only what changed. Connect GitHub, or start reviews from your CI or coding agent with the zerocool CLI. Read the docs

Do you check my fixes?

Yes. Every audit comes with a fix review. Once you patch the findings, Zero Cool verifies each fix and confirms the bug is actually closed.

Can I publish the Zero Cool report?

You own the findings and report delivered to you, and you can publish them. Tangent and Solarity publish their Zero Cool reports. Read the Terms

Who is behind Zero Cool?

Richie Humphrey and Kurt Willis founded Zero Cool. They met on the Trail of Bits blockchain security team, became Lead Security Researchers at Certora and Spearbit, and co-founded the security firm Offbeat Security. Meet the team

Next step

See what the agents find in your code.

Bring one repository at one commit. We will show you what the agents find, and the proof behind each finding.

Request a demoEmail sales@zerocool.ai