AaaS Configuration
Configuration Parameters
| Parameter | Options | Description |
|---|---|---|
| Model | Claude Opus, Claude Sonnet, GPT-4o, GPT-4o-mini, Llama, Deepseek, Gemini Ultra, Gemini Pro, Gemini Flash | AI model powering the agent |
| Target Type | Smart Contract (Solidity, Rust, Move), Web App (API, Backend, Frontend), Infrastructure | What kind of codebase to scan |
| Scan Depth | Shallow, Deep, Exhaustive | How thoroughly to analyze |
| Focus Areas (Web3) | Token transfers, Oracle logic, Access control, Reentrancy, Flash loans | Narrow the search space |
| Focus Areas (Web2) | Auth/AuthZ, SQL injection, SSRF, IDOR, API abuse, XSS, RCE | Narrow the search space |
| Budget | $10 — $10,000 | Compute spending cap |
| Severity | Critical only, High+, Medium+, All | Minimum severity to report |
| Custom Strategy | Free-text | User's own attack thesis (see Custom Strategy Editor) |
Model Selection Guide
| Model | Tier | Strengths | Cost | Best For |
|---|---|---|---|---|
| Claude Opus | Tier 1 (Premium) | Highest reasoning, complex multi-step analysis | $$$ | High-value targets, complex logic bugs |
| GPT-4o | Tier 1 (Premium) | Strong code understanding, broad knowledge | $$$ | Multi-language codebases, general scanning |
| Gemini Ultra | Tier 1 (Premium) | Large context window, good at architecture-level issues | $$$ | Large codebases, system design flaws |
| Claude Sonnet | Tier 2 (Standard) | Good balance of speed and accuracy | $$ | Most general scanning |
| GPT-4o-mini | Tier 2 (Standard) | Fast, cost-effective | $$ | Moderate complexity targets |
| Gemini Pro | Tier 2 (Standard) | Solid reasoning, good value | $$ | Standard Web3 scanning |
| Claude Haiku | Tier 3 (Budget) | Very fast, very cheap | $ | Broad surface scanning, triage |
| Gemini Flash | Tier 3 (Budget) | Fastest response time | $ | Quick reconnaissance |
| Llama | Tier 3 (Budget) | Open source, customizable | $ | Volume scanning, budget pools |
| Deepseek | Tier 3 (Budget) | Strong code reasoning for price | $ | Code analysis on a budget |
Target Type Details
Smart Contracts
- Solidity: Ethereum, Base, Arbitrum, Polygon
- Rust/Anchor: Solana programs
- Move: Sui, Aptos
Web Applications
- API: REST/GraphQL endpoint security
- Backend: Server-side logic, business logic flaws
- Frontend: Client-side vulnerabilities, DOM manipulation
Infrastructure
- Cloud misconfigurations
- Dependency/supply chain vulnerabilities
- Network-level issues