HackerNews中文版

嗨 HN，我们在观察到团队深陷充斥着理论漏洞的 AI 报告的泥潭后，开发了 TestMachine。这些漏洞从未得到修复，因为没有人知道哪些漏洞真正重要。我们构建了两个工具。Azimuth 针对您的智能合约运行真实的攻击模拟，并且只显示攻击实际成功的漏洞。不再需要对误报进行繁琐的筛选。Token Custody 在发布后持续监控链上代币行为，并在风险状况发生变化时发出警报——这很有用，因为代币在部署后几天或几周内（当升级或集成启动时）通常表现不同。其中有趣的技术点在于，我们在一个分叉链环境中，使用强化学习执行模拟，因此我们可以针对您的合约重放真实世界的状态，而不是运行静态分析猜测。 Coinbase 和许多审计机构都在使用它。很乐意回答有关该方法的问题。欢迎任何从事智能合约安全工作的人提供反馈。或者您可以去看看（我们刚刚添加了免费试用）。

查看原文

Hey HN,<p>We built TestMachine after watching teams drown in AI reports full of theoretical vulnerabilities that never get fixed because nobody knows which ones actually matter.<p>We built two tools. Azimuth runs real attack simulations against your smart contracts and only surfaces vulnerabilities where the attack actually succeeds. No more triage hell on False Positives. Token Custody watches on-chain token behavior continuously after launch and alerts you when risk profiles shift — useful because tokens often behave differently days or weeks post-deploy when upgrades or integrations kick in.<p>The interesting technical piece is that we execute simulations using reinforcement learning in a forked chain environment, so we can replay real-world state against your contracts rather than running static analysis guesses.<p>Coinbase and many auditors use it. Happy to answer questions about the approach. Would love feedback from anyone doing smart contract security. Or go check it out (we just added a free trial)

TestMachine，智能合约攻击模拟器，用于报告可被利用的漏洞。