adshao/flounder

What it solves

Flounder is an autonomous white-hat security auditor that automates the end-to-end process of auditing software targets. It replaces the need for human auditors to manually switch between tools and contexts by providing a structured workflow for target preparation, attack surface mapping, vulnerability discovery, and exploit construction.

How it works

Flounder acts as a thin workflow layer around a coding agent (such as Codex or Claude Code). Instead of relying on hard-coded bug rules or scanners, it leverages the reasoning capabilities of the LLM to decide how to audit a target. The system provides a secure, sandboxed execution environment (using OCI backends) to run model-generated tests and PoCs without risking the host machine.

The audit process follows a specific pipeline:

1. Prepare: Converts a clue (like a GitHub repo or transaction hash) into staged materials.
2. Map: Inventories the attack surface.
3. Dig: Performs deep audits of selected scopes.
4. Synthesize: Composes cross-scope candidates.
5. Verify: Confirms or refutes candidates via local execution.
6. Confirm: Reproduces findings against real-world ground truth.
7. Report: Packages reproduced bugs into Markdown reports.

Who it’s for

It is designed for white-hat security researchers, bug bounty hunters, and developers performing authorized security reviews, particularly those working with Solidity/EVM and ZK/proof-systems where local forks and harnesses can provide high-signal proof of vulnerabilities.

Highlights

• Execution-Grounded Findings: Findings are only upgraded to "real" if they are backed by a passing local command or PoC, rather than just model plausibility.
• Sandboxed Execution: Model-generated code and dependencies run in an isolated workspace with restricted Linux capabilities and network sealing to prevent host pollution.
• Framework-Agnostic: Does not encode specific language rules; the audit strategy is driven by the model, allowing it to improve as LLMs evolve.
• Autonomous Loop: Automates the entire cycle from initial target preparation to final report generation.
• Durable Evaluation: Supports running validated positive/negative control groups to track audit kernel performance and regressions.