Metadata-Version: 2.4
Name: aura-audit
Version: 0.5.0
Summary: Solidity smart-contract security tool: detect vulnerabilities, explain them in plain English, and generate verified fix diffs.
Author: Bhavish Goyal
License: MIT
Project-URL: Homepage, https://github.com/bhavi-g/AURA
Project-URL: Repository, https://github.com/bhavi-g/AURA
Project-URL: Issues, https://github.com/bhavi-g/AURA/issues
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3.11
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: fastapi
Requires-Dist: uvicorn
Requires-Dist: typer
Requires-Dist: sqlmodel>=0.0.22
Requires-Dist: sqlalchemy>=2.0
Requires-Dist: pydantic>=2.0
Requires-Dist: openai<2.0.0,>=1.55.0
Requires-Dist: anthropic<1.0.0,>=0.47.0
Provides-Extra: dev
Requires-Dist: pytest>=7.4; extra == "dev"
Requires-Dist: httpx>=0.27; extra == "dev"
Requires-Dist: requests>=2.31; extra == "dev"
Requires-Dist: pre-commit>=3.7; extra == "dev"
Requires-Dist: ruff>=0.4; extra == "dev"
Requires-Dist: black>=24; extra == "dev"
Requires-Dist: isort>=5.12; extra == "dev"
Requires-Dist: build>=1.2; extra == "dev"
Dynamic: license-file

AURA

**AURA (Automated Understanding & Remediation for Audits)** is a smart contract security tool that helps developers move from **vulnerability detection → explanation → fix**.

Most tools stop at reporting issues.
AURA goes one step further by generating **review-ready code diffs** developers can use during development and code review.

Website: https://aura-yab0.onrender.com

---

## What AURA does (in one minute)

**You give AURA**

* A Solidity smart contract (file or folder)

**AURA gives you**

* Detected security issues (rule-based)
* Plain-English explanations of why they matter
* **PR-ready remediation diffs** for specific vulnerabilities

AURA is designed to *assist developers*, not replace audits or expert review.


---

## Installation

AURA currently runs as a **CLI tool**.

### Prerequisites

* Python 3.11+
* `solc` and Slither available on `PATH` (see below)

### Install AURA

Recommended — isolated CLI install via [pipx](https://pipx.pypa.io/) (requires
`pipx`: `python -m pip install --user pipx && pipx ensurepath`):

```bash
pipx install aura-audit
```

Or with pip:

```bash
pip install aura-audit
```

Either way, the installed command is `aura` — `aura-audit` is just the PyPI
distribution name (`aura` was already taken by an unrelated project).

### Install solc and Slither

AURA's analyzers shell out to `solc` and Slither, which are not bundled with
the pip package and need to be on `PATH` separately:

```bash
pipx install solc-select
solc-select install 0.8.20
solc-select use 0.8.20

pipx install slither-analyzer
```

### Contributing / running from source

```bash
poetry install
poetry run aura --help
```

---

## Basic Usage

### 1️⃣ Analyze a contract

Detect vulnerabilities and get a summary score.

```bash
poetry run aura analyze contracts/Reentrancy.sol
```

Example output:

```
Findings: 3 | Score: 8.3
```

---

### 2️⃣ Explain findings (human-readable)

Summarize and prioritize the most important issues.

```bash
poetry run aura explain contracts/Reentrancy.sol
```

Example:

```
Found 3 issue(s). Here are the top 3:
1. [HIGH] reentrancy-eth
2. [LOW] low-level-calls
3. [LOW] solc-version
```

---

### 3️⃣ Explain + suggest fixes (LLM-assisted)

Generate explanations **plus remediation guidance**.

```bash
poetry run aura explain-llm contracts/Reentrancy.sol --fixes
```

What this does:

* Explains exploit impact
* Describes why the issue is dangerous
* Suggests a concrete fix pattern
* Outputs a patch-style diff

---

### 4️⃣ Generate a PR-ready diff for one issue

Produce **diff-only output** suitable for direct review.

```bash
poetry run aura fix contracts/RealWorldModern.sol --rule reentrancy-eth
```

Example output:

```diff
--- contracts/RealWorldModern.sol
+++ contracts/RealWorldModern.sol
@@ -15,8 +15,8 @@
 balances[msg.sender] -= amount;
 (bool ok, ) = payable(msg.sender).call{value: amount}("");
 require(ok, "ETH transfer failed");
```

---

## Example Workflow (recommended)

```bash
# Detect issues
poetry run aura analyze contracts/MyContract.sol

# Understand the most important ones
poetry run aura explain contracts/MyContract.sol

# Generate a fix for a specific rule
poetry run aura fix contracts/MyContract.sol --rule reentrancy-eth
```

---

## Limitations (important)

* AURA **does not replace** professional audits or formal verification
* Generated diffs are **best-effort suggestions**
* All fixes should be **reviewed by a developer**
* Results depend on underlying static analyzers

AURA is meant to **reduce friction**, not eliminate responsibility.

---

## Project Status

* Early-stage developer tool
* CLI-only (UI planned later)
* Actively evolving

Feedback, issues, and contributions are welcome.

---

## License

MIT


