Fidesium Product Update: Smarter Detection, Continuous Protection, Real-World Coverage

Detection Engine Upgrades (Core Technology)

Where your security really scales.

This month, we delivered major improvements to semantic coverage, multi-function reasoning, ML-powered false positive reduction, and new real-world exploit class detectors.

Full Call Graph Extraction

We’ve extended our analysis engine to extract complete function call graphs in addition to traditional AST parsing.

This allows Fidesium to follow how:

• data flows across functions
• inputs propagate through internal logic
  state is mutated in multi-step sequences

By understanding relationships between functions, we now catch sophisticated vulnerabilities that simpler AST-only analysis misses – especially multi-call, multi-component, and inter-procedural issues.

This is a foundational upgrade powering more accurate, context-aware detection across entire codebases.

2. ML-Powered State-Guard Reasoning (XGBoost Prototype)

Static analysis struggles with ambiguous patterns like:
multi-stage initialization

• state-dependent guard checks
• paused-mode behavior
• complex modifiers

Most scanners either flag too much noise or miss critical edge cases.

Our XGBoost-powered prototype solves this by learning semantic intent, not just syntax, using 62 AST-derived structural features.

The results are significant:

• 71% reduction in false positives overall
• 94% reduction on the hardest state-dependent guard patterns
• 100% recall maintained (no loss of detection coverage)

This shows our ability to bridge the gap between static logic and semantic context, and we are now evaluating how to deploy this model in production.

3. New & Enhanced Core Detectors

Your detectors are what protect your protocol. These improvements directly expand real-world exploit coverage.

Arbitrary Calldata Passing (High-Severity)

Unchecked external input passed into internal calls can enable:

• arbitrary code execution
• logic manipulation
• privilege escalation
• critical behaviour changes

Our enhanced detector now:
tracks tainted data across call, delegatecall, staticcall

• follows propagation through internal calls and modifiers
• flags unvalidated calldata flows before they reach dangerous execution points

This closes one of the most dangerous classes of Solidity vulnerabilities.

DoS via Unbounded Loops – Now Multi-Function Aware

Using our new call graph system, we now:

• trace loop bounds across function boundaries
• detect missing or broken bound checks
• respect legitimate guard conditions
• recognize invariant-style upper limits

Results:

• 67% fewer false positives
• 21% fewer false negatives

You get cleaner, more accurate alerts with almost no noise.

Fee-on-Transfer Token Accounting Risks

Fee-on-transfer tokens can break accounting logic and enable:

• silent balance drift
• mismatch between expected vs actual received tokens
• exploitable discrepancies in price and share calculations

Our upgraded detector now:

• tracks variable aliases across functions
• understands state changes inside modifiers
• interprets assembly-level function selectors
  follows multi-step accounting sequences end-to-end

This gives you robust protection against one of the most common sources of DeFi exploits.

Advanced Bounds & TOCTOU Validation

We upgraded bounds detection to handle:

• modifier-based checks
• in-memory array bounds
• large invariant constraints
• multi-function state changes

Critically, we now catch TOCTOU (Time-of-Check Time-of-Use) vulnerabilities where a state is validated in one function
but changed before the actual array or index use

This stops an entire class of real-world array-based exploits.

Rounding Error Exploit Detection (Post-Balancer Class)

Following the Balancer exploit class, we built a specialised detector to ensure:

• rounding always favors the protocol
• paired scaling & rounding operations are symmetric
• intermediate rounding can’t be exploited for economic advantage

This catches subtle yet high-impact mathematical vulnerabilities that have caused multi-million dollar losses across DeFi.