Methodology
What it checks, and what it misses
Every rule below is read from the engine at build time, so this page lists exactly what runs. Each was written against the published Robinhood Chain documentation, verified 2026-09-18.
Detection first, explanation second
Findings are produced by matching patterns against the code’s syntax tree — never by asking a model to look for bugs. A rule fires only when it can trace where a value came from, which is the whole difficulty here: the same multiplication is required on a raw price from /prices and forbidden on a Chainlink answer, which already includes it.
A language model is used afterwards, and only on findings that already exist: it explains them and drafts a patch. Whatever it returns is checked against the same list of documented endpoints and contract functions the prompt was built from, so a fix that invents an API is rejected rather than shown as ready to paste. The report is complete without it.
The 11 rules
- CriticalRH001
Raw underlying price shown as token price
TypeScript
- CriticalRH002
Chainlink feed price multiplied a second time
TypeScript · Solidity
- CriticalRH003
Stock token address hardcoded without validation
TypeScript
- CriticalRH004
Chain ID is not Robinhood Chain mainnet
TypeScript
- CriticalRH005
Feed price used without a staleness check
TypeScript · Solidity
- WarningRH006
Paused oracle indistinguishable from a broken feed
TypeScript · Solidity
- WarningRH010
pendingMultiplier not handled
TypeScript
- WarningRH011
Trading action offered without checking tradingCapabilities
TypeScript
- WarningRH012
Raw token balance displayed without the UI-adjusted view
TypeScript
- InfoRH007
No sequencer-liveness guard on an L2 price read
TypeScript
- InfoRH020
Polling faster than the endpoint cache window
TypeScript
This is a code analysis aid, not a security audit.
- Findings come from pattern matching against public Robinhood Chain documentation. A clean result means these specific patterns were not found — it does not mean the code is correct or safe.
- Analysis is per-file. Values that cross module boundaries are not traced, so real bugs can be missed.
- Test, mock, example and scripts/ directories are not scanned. Code that runs in production from those locations is not checked.
- Suggested fixes are generated by a language model and machine-checked only for inventing APIs that do not exist. They are not checked for correctness. Read and test every one before using it.
- No formal audit, certification, or security guarantee is offered or implied.
- Nothing here is investment advice. This tool analyses code, not assets.
What happens to your code
- Public repositories are downloaded as an archive from GitHub, analysed, and discarded. So the same code is not downloaded twice, the archive is kept in memory for up to an hour and may also be held in Cloudflare's cache.
- Uploaded zips are scanned and dropped within the request — never cached or stored.
- No wallet connection, no signing, no transactions. The tool never holds a key and never writes to any chain.
- Scan history is not stored.