TypeScript
TypeScript security review
TypeScript is JavaScript with types, often used for bots, backends, and services that talk to a blockchain. Hackerbane audits the TypeScript that signs transactions, holds keys, or turns model output into an action.
scope
What we review
We review the TypeScript that can sign or send, not every package in the monorepo. Typical issues are a tool argument that is never checked, a key in the same process as untrusted input, and model output that goes on-chain as-is.
Tool schemas that let a model pick recipients, amounts, or calldata the application should have checked.
Signers and keys in the same process as prompts and untrusted RPC.
Bots that send a transaction because a model score or an RPC price crossed a threshold.
Model output sent on-chain with no allowlist, amount cap, or human check.
Indexers that treat a reorg or a bad node as the chain.
Advanced Threat Detection
We built our own advanced threat detection stack that is more performant and cheaper than our competitors. We use a state-of-the-art AI harness coupled with world-class senior security engineers with proven experience finding vulnerabilities in well-tested software.
How we review this language
A TypeScript review follows the same five-stage engagement as every Hackerbane audit. We start from untrusted input (a prompt, a tool call, or an RPC reply) and follow it to the signer.
Two senior engineers read the code in parallel with the compiler and tests running. We trace each path from that input to a signed transaction, including the contracts and APIs it calls.
Scope and threat model
We lock the repo, the commit, and what the process can call: the signer, the RPC endpoints, and each tool the model can reach, before the review starts.
Architecture and design review
We map every path from untrusted input, a prompt, an RPC result, or a tool argument, to the action that signs or spends, then judge the design against it.
Hybrid code and infrastructure review
Two senior engineers read the TypeScript in parallel, with tsc under strict settings, type-level checks, and tests that drive the agent loop with hostile input.
Exploitability and root-cause analysis
High and Critical findings ship with a runnable proof against the agent and the root cause, so the whole class of unchecked model output gets closed.
Reporting and remediation
A prioritized report, a live walkthrough, and verification of every in-scope fix within the remediation window.
Tools and practices
We work in the repository you already use. tsc, node, and your test runner stay in place. We add stricter compiler settings, boundary tests, and proofs, then hand those artifacts back with the report.
What you get
Prioritized findings your engineers can ship against, each with root cause and a recommended fix.
Runnable proofs of concept for High and Critical issues.
A report you can share with partners, investors, and counterparties.
Remediation verification and a final report that reflects the fixed state of the system.
The boundary tests used on tool arguments, RPC replies, and signer paths.
How to prepare
| # | Before review starts |
|---|---|
| 01 | The project builds and tests run cleanly from a fresh checkout. |
| 02 | The code is stable, with no major refactors planned mid-audit. |
| 03 | What the process can sign, spend, index, or call is documented. |
| 04 | Trust assumptions for prompts, tools, and RPC endpoints are written down. |
| 05 | Scope is defined: which packages, which commit, and which deployment. |
Other pages
Questions
- Is this a lint pass?
- No. We start from what the process can sign or send, then follow every path from a prompt, a tool call, or an RPC reply to that action.
- Do you review the model as well?
- We review what the code does with a model output. The output is untrusted. The check that turns it into a signed send is the audit.
- Can you review the contracts the agent or keeper calls?
- Yes. When the TypeScript signs against a contract we scope both, so the off-chain caller and the on-chain code are reviewed together.
Next step
Request an audit
Share the repo, what the TypeScript process can sign or call, and your timeline. We will propose an audit plan and estimate.