Prove it. Or drop it.

A finding is a claim until an exploit settles it. Quorum hunts EVM contracts, then writes a Foundry exploit on a fork and publishes only what actually drains the attacker's balance. Four real 2026 hacks, proven to the wei. Each proof settles as a paid on-chain claim, live on Robinhood Chain and Arbitrum One. It began as a memory experiment — flip the switch below to see that origin.

2confirmed

Proven by running the exploit

Unistreet — 0.0072 WETH
Sandbox — 1,000,000 SAND
Squid — 712 USDC
GaslessReservoir — 0.836 WETH, blind

The on-chain claim layer is live: Robinhood Chain · Arbitrum One

The proofs The origin: ten lenses

The deletion test

Memory on

The same ten lenses on the same two files, memory on and then memory off. Flip the switch to read what each run confirmed.

$ quorum run --targets fixtures/VulnerableVault.sol fixtures/OpenFeeSetter.sol
  QUORUM    VulnerableVault.sol:withdraw   reentrancy   corroborated by callorder-lens, guard-lens
  QUORUM    OpenFeeSetter.sol:setFeeRate   unguarded-state-write   corroborated by modifier-lens, sender-lens
scanned 20 lens-units | confirmed 2 | recalled 1 | candidates 5

# same swarm, same contracts, memory removed
$ quorum run --no-memory --targets targets/*.sol
scanned 40 lens-units | confirmed 0 | recalled 0 | candidates 26
nothing was confirmed, recalled or suppressed: without memory the swarm
cannot corroborate, recognise or forget.

The numbers

Measured. Every file kept.

Ten lenses over 143 contracts with known bugs, a second set of ten bugs they were never tuned on, and Slither run on the same files with the same rule. Each panel links to the file that produced it. Measured against recent audits as well: of 131 findings across 16 contests, the four risks here are 5% of what was reported, and the rule confirms two of those 7, after a ninth lens was built for that gap. That file names every miss.

Right when it flags

reentrancy

72%

One lens alone: 31%
Two must agree: 72%

Of the flags Quorum raises for the most common bug, on 143 contracts with known bugs, this many are right.

The file

Bugs found

eleven runs

1%64%

first runeleventh run

Recall on the same 143 contracts, from the hackathon build to today. Every before-file is in the repo.

The file

Against Slither

Measure	Quorum	Slither
Reentrancy, flags right	72%	62%
Access control, found	10%	33%
Arithmetic, found	81%	0%

Same files, same rule. The row Slither wins stays on the page.

The file

MIT licensed. Memory is a local file; nothing is uploaded. Code · Telegram