Vibranium Audits · R.I.T.A. Methodology
No black box.
Every point in a R.I.T.A. score is attributable to a finding you can see, with the weight printed next to it. Rules are authored by the auditors behind 480+ smart-contract audits — not an unexplainable model.
Scan risk score (0–100, higher = riskier)
Starts at 0; each finding adds its weight; capped at 100. Verdicts: ≥60 red flags · 25–59 review recommended · <25 no automated flags. Informational findings carry zero weight.
| Finding | Weight | Notes |
|---|---|---|
| OFAC-sanctioned address | +80 | CRITICAL — appears on the U.S. Treasury SDN list (self-hosted, refreshed daily) |
| Honeypot token | +60 | HIGH — buyers may be unable to sell (GoPlus) |
| Scam-list match | +50 | HIGH — recorded phishing / stealing / cybercrime activity |
| Unlimited approval to unverified spender | +40 | HIGH |
| Owner can mint / hidden owner | +30 | MEDIUM — skipped for trust-listed tokens (USDT/USDC have these by design) |
| Flagged-address interaction | +25 | MEDIUM |
| Mixer exposure / high transfer tax (≥10%) | +20 | MEDIUM |
| Unverified contract source | +15 | MEDIUM |
| Blacklist function present | +5 | LOW — a capability, not evidence of use; also skipped for trust-listed tokens |
Protocol security score (Monitor, 100 → 0)
Starts at 100; open incidents subtract until triaged (acknowledged, resolved, muted, or marked false-positive). Repeated identical events within a cooldown window fold into one incident — alert quality over alert volume.
| Open CRITICAL incident | −40 |
| Open HIGH incident | −25 |
| Open MEDIUM incident | −10 |
| Open LOW incident | −5 |
Detector validation — historical incidents replayed
Alert would have read: Reentrancy pattern — the victim contract was re-entered on the SAME function while an earlier call was still executing (81 same-function re-entries in one transaction). The exact shape of a reentrancy exploit. In the real Aave V3 Pool traffic we measured, normal composability produced zero same-function re-entries.
Scope: we detect same-function reentrancy — the canonical class (Rari/Fei, TheDAO). Cross-function reentrancy is not currently claimed; a multi-signal rule for it is on the roadmap.
Alert would have read: Large outflow detected — the watched bridge contract transferred 25,500,000 USDC out to an external address in a single transaction, far above the alert threshold.
Live coverage right now: 3 watch targets under continuous monitoring across 3 customer protocols, with 12 detector checks armed. Real counts from the database — our own internal, demo and test workspaces are excluded — and we only ever show detections we actually made.
What we promise — and what we don't
- Read-only, always. R.I.T.A. never holds keys, never signs, never moves funds.
- Detect and alert — automated response is an optional integration where you grant the control; R.I.T.A. itself never intervenes.
- Sources degrade gracefully: if a data provider is down you get a partial result that says so — never a silent gap.
- Detection assistance, not a guarantee. A clean result lowers risk; it does not eliminate it.
- Latency figures are labeled target until measured in production.