Skip to main content

Attack Simulation

During Investigation, Azimuth runs four parallel agents to validate proposals against live contract execution. Each agent has access to 15 tools for interacting with and probing the target.

How it works​

Investigation agents take the prioritized proposals from the Consolidation stage and attempt to prove or disprove each one through actual execution. This goes beyond static analysis—agents craft transactions, manipulate state, and observe outcomes in a real EVM environment.

Execution environment​

Each investigation session spins up forked EVM instances so agents can:

  • Execute transactions against the target contracts
  • Manipulate block state (timestamps, block numbers, balances)
  • Fork from mainnet to test against real deployed state
  • Run scenarios in isolation without interference between agents

Parallel agents​

Four agents work in parallel, each armed with 15 tools. Agents independently investigate different proposals, maximizing coverage and throughput. If one agent finds confirming evidence for a vulnerability, it produces a finding with supporting detail.

What agents look for​

Agents investigate the three proposal types from the Proposal stage:

  • Economic — Can value be extracted, drained, or manipulated through token economics, fee structures, or incentive misalignment?
  • Structural — Are there access control gaps, state management errors, or architectural weaknesses that can be exploited?
  • Invariant — Can any of the identified invariants be violated through crafted transaction sequences?

Findings​

Each confirmed finding includes:

  • Severity — critical, high, medium, or low
  • Likelihood — how likely the issue is to be exploited in practice
  • Impact — the potential consequence if exploited
  • Evidence — the transaction sequences, state changes, and reasoning that support the finding

How this differs from fuzzing​

Traditional fuzzers generate random inputs and hope to trigger failures. Azimuth's investigation agents are guided by the proposals from earlier stages—they know what to look for and where to look. This targeted approach finds complex, multi-step vulnerabilities that random exploration would miss.

Supported environments​

Investigation runs against contracts compiled with Foundry or Hardhat. Agents can fork from any supported EVM network to test deployed contracts against real state.