Complete Solidity security: Wake Framework (open-source) for testing & fuzzing + Wake Arena for AI audits with graph-driven reasoning. By @AckeeBlockchain
EVM
- Tweets 6,465
- Following 137
- Followers 2,220
- Likes 8,026
Pinned Tweet
Four AI auditing tools. Fourteen protocols. The shape tells the story.
Wake Arena 3.1's blue area contains the other three on every axis.
Where all systems struggle — Burve, Notional — the gap closes.
Where the work matters — Lend, Munchables, Virtuals — the edge is visible and consistent.
What the chart doesn't show: 49 of the 63 found vulnerabilities were confirmed by more than one Wake Arena agent independently.
The shape reflects consensus, not a single model's guess.
Learn more ↓
10
2
22
1,460
1/
LLM performance is not uniform across programming languages: it tracks training-data representation, and Solidity sits at the low-resource end.
In 2026, the strongest agent evaluated detects 45.9% of real Solidity vulnerabilities; LLM-written Solidity tests are 2–4.6% correct.
The evidence:
1
1
9
1,020
8/
This is the design rationale of Wake: contracts in Solidity, tests and fuzzing in Python, identical EVM semantics.
Generation falls on the language where measured model capability is highest; human review concentrates on test logic rather than language mechanics.
→ getwake.io
1
73
9/
Sources:
StarCoder — arxiv.org/abs/2305.06161
MultiPL-E — doi.org/10.1109/TSE.2023.326…
CangjieBench — arxiv.org/abs/2603.14501
EVMbench — arxiv.org/abs/2603.04915
LLM Solidity tests — arxiv.org/abs/2505.05584
COMPSAC 2026 — arxiv.org/abs/2605.11163
61
On 94 high-severity findings from Code4rena and Sherlock protocols:
Wake Arena 3.1 caught 63 — 67%.
Nearest competitors, GPT-5.2 xhigh and Zellic v12, caught 41 — 44%.
Public, reproducible, labels taken as-is. Some models may have trained on these codebases — fair caveat.
→ github.com/Ackee-Blockchain/…
2
261
Bridges fail because testing one chain at a time misses the interaction bugs.
Cross-chain protocols introduce synchronization challenges that single-chain tests cannot replicate.
Different block times.
Event relay timing.
State consistency across networks.
Testing these in isolation creates false confidence.
The contract works on Ethereum.
Works on Polygon.
But fails when they interact.
Wake was designed from day one with multi-chain as a first-class citizen.
Not an afterthought.
Not a plugin.
Built-in.
Spin up multiple blockchain instances in one test suite.
Each maintains independent state, accounts, and configuration.
Fork mainnet on both chains simultaneously.
Test realistic cross-chain scenarios with production token contracts and actual network conditions.
The framework enforces chain-specific account usage.
Can't accidentally deploy an Ethereum contract using a Polygon account.
Can't transfer funds across chains without explicit relaying logic.
This prevents an entire class of testing mistakes while making complex multi-chain scenarios straightforward to express.
Real bridge exploits often emerge from timing assumptions, failed relay attempts, or reorg handling.
Wake lets you simulate these edge cases systematically: chain reorganizations, message ordering issues, and timeout scenarios.
One cross-chain DEX aggregator caught a critical synchronization bug during Wake testing that would have drained user funds during high network congestion.
The bug only manifested when both chains processed transactions simultaneously with specific timing.
Multi-chain protocols are complex.
Testing infrastructure shouldn't make them harder.
With built-in mainnet forking, independent time manipulation per chain, and intuitive Python APIs for cross-chain logic, Wake gives teams the testing foundation that distributed protocols require.
Cross-chain testing should be straightforward, not heroic.
Discover Wake's multi-chain capabilities ↓
5
221
Most security checks happen after code review.
`wake detect` runs the same detectors used in Ackee audits before anyone opens a PR.
Here's how to add a security gate to your pipeline:
Thread ↓
7
1
12
313
3/ Pair detectors with fuzzing for layered coverage:
Static analysis catches known bad patterns.
`wake test -P 5` explores unexpected runtime behavior.
Structure + behavior — the gap most CI pipelines leave open.
1
1
42
4/ Security gates in CI mean auditors review cleaner code.
• Follow @WakeFramework for more insights
• Retweet the 1st tweet to help others
Get Wake:
getwake.io
1
40
Coverage percentages hide the dangerous code paths.
"92% coverage" sounds reassuring until you realize the missing 8% contains your entire liquidation logic.
Traditional coverage reports show numbers.
Wake's VS Code extension shows the actual untested code, highlighted directly in your editor as you write contracts.
Green shows executed paths.
Red marks untested sections.
Execution counts appear inline.
Revert error coverage highlights which error conditions tests actually trigger.
The visualization changes how developers approach testing.
Instead of chasing percentage targets, focus shifts to the code that matters.
Complex branching logic.
Edge case handlers.
Critical security functions.
One DeFi protocol team discovered their emergency pause mechanism had zero test coverage despite 94% overall coverage.
The percentage metric masked the gap.
Visual highlighting made it obvious.
During security audits, this becomes invaluable.
Auditors immediately see which contract areas lack test validation.
Developers can target testing efforts precisely where vulnerabilities hide.
The setup is immediate.
Add ``--coverage`` to your test command.
Run your test suite or fuzzing campaign.
Wake generates a coverage file automatically.
Open the command palette in VS Code.
Select "Show Coverage."
Choose your coverage file.
Your contracts transform with color-coded insights.
The extension displays execution counts for each line, making it trivial to spot code that runs once versus code that executes thousands of times during fuzzing campaigns.
This matters for fuzzing, especially.
You're running thousands of iterations.
Which branches actually execute?
Which error conditions actually trigger?
Visual coverage answers instantly.
Testing thoroughness shouldn't require detective work.
Wake turns abstract coverage metrics into actionable visual feedback.
See gaps at a glance.
Build more secure contracts.
Start visualizing your test coverage ↓
1
2
442
The full leaderboard: 9 systems, 94 critical/high-severity findings:
• Wake Arena 3.1: 63/94 (67%)
• Wake Arena 3.0: 43/94 (46%)
• GPT-5.2 xhigh: 41/94 (44%)
• Zellic v12: 41/94 (44%)
• GPT-5.2 high: 37/94 (39%)
• GPT-5 base: 24/94 (26%)
• Opus 4.5: 21/94 (22%)
The second-best result on this benchmark belongs to our previous version.
"Your only competition is yourself," they say.
Learn more ↓
2
2
4
358
Labels are from Code4rena and Sherlock, taken as-is.
• Follow @WakeFramework for that release
• Repost to keep AI audit benchmarks honest
Benchmarks: github.com/Ackee-Blockchain/…
Try Wake Arena:
ackee.xyz/wake/arena
2
87