Cross-Chain Exploit Detection System (CCEDS)

CCEDS is a defensive, multi-chain security platform for EVM ecosystems. It combines a fast built-in Solidity security scanner, optional Slither/Mythril adapters, cross-chain replay-risk correlation, live JSON-RPC monitoring, a REST API, CLI, SARIF output for CI, and an optional MCP security agent interface.

Scope: CCEDS is a defensive analysis tool. Findings are heuristics and should be verified by a qualified security reviewer before making security decisions.

What it detects

Solidity source analysis

• Reentrancy risk (external value call before state update)
• tx.origin authorization
• Dangerous delegatecall
• selfdestruct
• Unchecked low-level calls
• Weak on-chain randomness patterns
• Sensitive public/external functions without obvious authorization
• Signature-domain / cross-chain replay risk
• Timestamp-dependence heuristics

Cross-chain monitoring

• Transaction/message fingerprints observed on more than one configured chain
• Chain-agnostic payload reuse that may indicate missing domain separation
• Replay observations stored with chain, sender, recipient, value, payload and block metadata

Integrations

• Slither (optional)
• Mythril (optional)
• EVM JSON-RPC nodes: Geth, Erigon, Nethermind, Besu, Anvil, Ganache, hosted RPCs
• Hardhat / Foundry / Truffle demo lab
• MCP server for agent-to-agent security checks

Architecture

Solidity / RPC Events
        |
        v
+------------------+       +-----------------------+
| Built-in Scanner |------>| Normalized Findings   |
+------------------+       +-----------------------+
        |                           |
        | Slither / Mythril         v
        +--------------------> SQLite/Postgres
                                    |
RPC chains -> Monitor -> Replay Correlator ----+
                                    |           |
                                    v           v
                                  REST API     CLI/SARIF
                                    |
                                    v
                               MCP Security Agent

See docs/ARCHITECTURE.md for details.

Quick start

git clone https://github.com/Vinaysati/Cross-Chain-Exploit-Detection-System.git
cd Cross-Chain-Exploit-Detection-System
python -m venv .venv
source .venv/bin/activate  # Windows: .venv\\Scripts\\activate
pip install -e ".[dev]"

cceds scan contracts/vulnerable/ReentrancyVault.sol
cceds scan contracts/vulnerable/ReplayBridge.sol --format sarif -o report.sarif

Run the API:

cp .env.example .env
cceds serve --host 127.0.0.1 --port 8000

Then open http://127.0.0.1:8000/docs.

Configure chains

Set only the RPCs you want to monitor:

export ETHEREUM_RPC_URL=https://...
export BSC_RPC_URL=https://...
export ARBITRUM_RPC_URL=https://...
export POLYGON_RPC_URL=https://...
export BASE_RPC_URL=https://...

Check connectivity:

cceds chains
cceds monitor --chain ethereum --once

Cross-chain replay correlation

Observe an application-level message or EVM transaction payload:

cceds replay-observe \
  --chain ethereum \
  --chain-id 1 \
  --sender 0x1111111111111111111111111111111111111111 \
  --receiver 0x2222222222222222222222222222222222222222 \
  --value 0 \
  --payload 0xabcdef \
  --tx-hash 0xaaa

If the same chain-agnostic fingerprint appears on another chain, CCEDS emits a replay-risk finding. This is intentionally a risk signal, not proof of exploitation.

Optional external analyzers

pip install -e ".[security-tools]"
cceds scan Contract.sol --slither --mythril

External tools run as subprocesses with timeouts and their output is normalized into the same finding model.

MCP / NANDA-style security agent

pip install -e ".[mcp]"
cceds-mcp

The MCP server exposes:

• scan_solidity_source
• observe_cross_chain_message
• recent_findings

This allows other agents to request a defensive security assessment before executing a sensitive blockchain action.

Docker

docker compose up --build

The default compose stack starts the API with PostgreSQL. For local development, SQLite works out of the box.

Hardhat / Foundry / Truffle lab

The contracts/ directory contains intentionally vulnerable examples for validating detectors. Do not deploy the vulnerable contracts with real funds.

npm install
npx hardhat compile
# or
forge build
# legacy local lab
npx ganache --wallet.totalAccounts 10
npx truffle compile

Tests

pytest
ruff check .
python -m compileall src tests

Security model and limitations

CCEDS is designed to assist engineers and auditors, not replace manual review. Static rules can produce false positives or false negatives. Cross-chain correlation cannot, by itself, prove that a replay is unauthorized. See SECURITY.md and docs/THREAT_MODEL.md.

Responsible use

Use this project only on systems and smart contracts you own or are authorized to assess. The included vulnerable contracts are local test fixtures.

License

MIT © Vinay Sati