Ultrafuzz

What it is

Ultrafuzz is an agentic orchestrator for smart contract fuzzing and threat hunting, released by the Monad Foundation under the MIT license. It sets up a protocol repository with editable prompts and topology, runs specialized agents, and collects the fuzz tests and findings they generate. It is under active development.

What it helps with

- Scaffolding a campaign with ultrafuzz init, including topology, prompts, and pinned references
- Running AI agents such as Claude Code and Codex to write Foundry fuzz and invariant tests
- Reviewing results in a local dashboard and a final report
- Keeping generated changes as artifacts until you copy reviewed outputs in with ultrafuzz materialize

Who it's for

Security researchers auditing a protocol and protocol developers hardening Solidity code before or during review.

Worth knowing

Run Ultrafuzz only on an ephemeral, isolated virtual machine you can discard afterwards, never on a developer workstation or a host with valuable data or credentials. Its agents run in an unrestricted, skip-permissions workflow and may install or access dangerous tooling. The project recommends a published release that has been out for at least seven days, and reviewing its prompts before a campaign.

Is Ultrafuzz free?
Yes, it is MIT licensed, though the AI agents it drives may need paid model accounts.

Why does it need a disposable VM?
Its agents run without permission prompts, so prompts or target behavior could lead to destructive actions on the host.

How does it relate to Echidna, Foundry, and Slither?
In our view Ultrafuzz automates writing Foundry fuzz tests with AI, while Echidna is a classic fuzzer and Slither handles static analysis.