INDEPENDENT R&D / SOFTWARE / AI / SECURITY
Ghost Labs designs and builds custom software and AI systems, Solidity and EVM applications, and specialist tools for rigorous testing and technical research. We take on problems from architecture through implementation—and help teams understand how their systems behave when conditions get complicated.
Independent R&D studio
Ghost Labs works across product engineering, applied AI, blockchain systems, and security research. We turn ambiguous technical goals into architectures, implementations, and tools that fit the real environment—not just a convincing demo.
Some engagements need a complete application; others need a stateful contract failure reproduced, a complex execution trace explained, or compiler behaviour made measurable. We start with the uncertainty that matters, then choose methods that can produce useful, inspectable evidence.
Alongside client work, we build our own engineering technology—from EVMTraceX, our execution-trace explorer, to STATEHOUND, our stateful EVM fuzzing and research engine. Our internal R&D also explores complete AI workflows, reproducible transaction analysis, and compiler-level performance evidence.
See how we workWhat we build
Product engineering, applied AI, blockchain systems and deep technical investigation—combined to fit the actual problem, not forced into a fixed package.
Engineering the product behind the idea.
We design and deliver software around the way a product actually operates: backend services, APIs, integrations, internal platforms, automation and complete application workflows. Architecture, data contracts, observability, deployment constraints and maintainability are part of the delivery—not an afterthought.
AI products engineered beyond the API call.
We do more than connect a model to an existing app. We can build the AI system around a use case from the ground up: application logic, data pipelines, custom model or agent components where the scope calls for them, orchestration, evaluation loops, APIs, interfaces, asynchronous jobs, and controls that make the workflow dependable. Existing models and providers are options—not the entire solution.
Contracts, integrations and execution-level tooling.
We work where contract logic meets protocol state and production tooling. Scope may include Solidity implementation, EVM application architecture, blockchain integrations, debugging multi-contract calls, storage-change analysis, and execution-aware developer utilities. The focus is on how components interact across callers, dependencies, state, and deployment assumptions.
Focused reviews backed by adversarial testing.
We examine the security properties of smart contracts through scoped manual review and adversarial testing: permissions, trust boundaries, upgrade paths, external calls, state transitions, and economic assumptions. Findings are tied to observable behaviour and practical remediation guidance, with the scope and limitations made explicit.
Tools that make complex behaviour observable.
We build test infrastructure and developer tools for problems where conventional tests provide limited coverage. Our work includes purpose-built fuzzing engines, execution-trace analysis, reproducible test generation, compiler-optimization evidence, and low-level systems research. The objective is an answer engineers can inspect, reproduce, and act on—not another layer of guesswork.
Security R&D / Stateful Testing
UNDERSTAND THE SYSTEM.
TEST THE ASSUMPTIONS.
SMART CONTRACT SECURITY / ADVERSARIAL TESTING
A contract can pass its expected flow and still fail when calls are composed, state evolves over many transactions, or an assumption breaks at the boundary. We examine the behaviour across sequence, state, permissions, external calls, and economic conditions—not only isolated functions.
Our in-house EVM fuzzing engine, STATEHOUND, combines execution-coverage feedback, behavioural novelty, and reinforcement learning. PPO helps adapt the search strategy; RND-style novelty signals encourage exploration of unfamiliar states and behaviours. Together, they guide mutations through complex, stateful execution paths and multi-transaction sequences, looking for candidates where configured invariants or assumptions about permissions, reentrancy, or economic behaviour may fail.
The engine runs in controlled test environments. It prioritises promising behaviours for investigation; a heuristic, raw execution, or positive balance delta is not by itself a confirmed vulnerability. Candidate findings are assessed against state changes and trace evidence, then reproduced where feasible. The result is a stronger basis for review and remediation—not an automatic security verdict.
Every engagement has a defined scope and a clear account of what was tested, what was observed, and what remains uncertain. For the broader process, see how we validate engineering work.
IN-HOUSE SECURITY RESEARCH / PYTHON + RUST
STATEHOUND is our stateful EVM fuzzing and research engine. It explores execution beyond isolated calls, using runtime feedback, behavioural novelty and PPO/RND-guided search to prioritise sequences for investigation.
STATEHOUND is one layer of a scoped smart-contract security review—not an automatic security verdict. Before a run, we define the target, fork/state context, assumptions and evidence required to evaluate a result. Candidate behaviours are assessed against execution traces and state or value effects, then reproduced where feasible.
Mutate and compose calls while carrying forward successful state changes, probing behaviour that isolated function tests can miss.
Execution coverage and behavioural novelty feed the search loop. PPO guides policy updates, while RND-style intrinsic reward encourages exploration of less familiar observations.
Target-interface data, selectors, call arguments, comparison operands and observed storage values help steer mutations toward meaningful execution paths.
A mechanism flag or promising balance delta is only a candidate. The pipeline checks supporting runtime evidence and can prepare replay or Foundry-oriented artifacts where feasible.
AUDIT SURFACE / TARGET-DEPENDENT
Test cases and invariants are adapted to the contract, dependencies and available execution context. These are investigation areas, not a promise that every class applies to every protocol.
Authorization boundaries, ownership or control transitions, upgrade assumptions and configured state invariants.
Multi-call paths, cross-contract interactions, callback behaviour and changes to storage or accounting across steps.
External-call and proxy execution paths, with attention to observed control or asset impact—not mechanism flags alone.
Native/token value movement, drain conditions and configured flash-loan, AMM or oracle scenarios when the test harness models them.
FROM SEARCH TO EVIDENCE
Define the target, fork or state baseline, preconditions, invariants and what constitutes meaningful impact.
Use mutations, execution feedback and learning-guided search to discover candidate behaviours.
Inspect successful state and trace evidence, then reproduce selected findings where feasible.
For suitable engagements, we pair stateful fuzzing with manual review, target-specific invariants and practical remediation guidance. Scope, assumptions and limitations remain explicit.
Discuss a STATEHOUND-assisted reviewTools & Research
We build tools to inspect runtime behaviour, reconstruct complex transactions, and reason about low-level system performance. EVMTraceX is our public project; other research systems remain in development.
OPEN-SOURCE TOOL / RUST
A keyboard-driven Rust TUI for inspecting EVM call traces, gas usage, reverts, selectors, and storage changes.
Load supported Geth-style callTracer JSON or Foundry traces to navigate nested calls and inspect callers, targets, function selectors, gas usage, errors, revert reasons, and storage diffs. Filters help isolate reverted frames, changed storage, addresses, and selectors relevant to the investigation.
Use local trace files by default, or explicitly configure an RPC endpoint that supports debug_traceTransaction. EVMTraceX makes execution evidence easier to inspect; it does not label a contract vulnerable or replace a security review. For broader validation work, see our smart-contract testing approach.
Release notes include SHA-256 checksums for verifying each archive.
Release notes, source & SHA-256 checksumsBeyond the public trace explorer, our lab develops complete AI workflows, reproducible trace-to-test pipelines, and compiler-intelligence tooling for Rust/LLVM. Some systems remain internal R&D rather than public releases; the research informs how we build applications, test complex behaviour, and investigate performance.
How we work
The steps stay transparent; the technical methods adapt to whether we are building a product or investigating system behaviour.
Define the objective, constraints, systems in scope, the decision to support, and observable success criteria.
Map dependencies, data and state boundaries, failure modes, and test strategy before implementation or investigation.
Implement the solution, exercise realistic scenarios, and use tests, traces, and measurements to refine it.
Reproduce key results where possible, document the evidence and limitations, and deliver the agreed code, findings, or next steps.
Working together
We work remotely with teams who need a product built, a technical bottleneck investigated, or a system tested beyond its expected path. An engagement can be an end-to-end build, a defined engineering workstream, or a focused research investigation.
Before starting, we agree on scope, access, dependencies, deliverables, acceptance criteria, and communication cadence. Budget follows the agreed work and constraints; we do not force unlike problems into identical packages.
The handoff is explicit: what changed, what the tests showed, what remains uncertain, and what decision the evidence supports. This matters especially when an AI workflow or security finding depends on assumptions and operating conditions.
Start a conversationFrequently asked questions
Answers to the questions that matter before a technical engagement begins.
We build custom software and AI systems, engineer Solidity and EVM applications, and work on smart-contract security, developer tooling, and technical R&D. The capabilities section outlines the main disciplines; selected work and R&D shows how some of that engineering takes shape.
We build the system around the use case: application logic, data handling, model orchestration, evaluation, APIs, interfaces, and asynchronous workflows. Integrating an existing model may be the right choice, but it is only one design decision—not the whole service. See our AI product engineering scope.
Yes. Depending on the agreed scope, a review can combine manual Solidity analysis, threat modelling, targeted tests, stateful fuzzing, execution-trace investigation, and remediation guidance. We define the contracts, assumptions, dependencies, and deliverables before work starts. Details are in our smart-contract security approach.
Built in-house from the ground up, it combines execution coverage, behavioural novelty, and reinforcement-learning methods. PPO helps guide the search policy; RND-style novelty signals encourage exploration of unfamiliar behaviour. The engine generates and explores complex, stateful call sequences to look for candidates where invariants configured in the test setup may fail. It supports a controlled assessment workflow; results still need contextual review and reproducible evidence. See how we use fuzzing in security testing.
We inspect the relevant execution and state changes, identify the assumptions behind the result, and reproduce the behaviour where feasible. For suitable transaction evidence, replay tests can help distinguish an observed signal from a demonstrated outcome. Our EVMTraceX tool helps engineers examine traces; it is an analysis tool, not an automatic vulnerability scanner.
We align on the objective, systems in scope, dependencies, constraints, deliverables, and acceptance criteria before agreeing on a plan. Pricing depends on the type and complexity of the work; we do not publish a one-size-fits-all package. Start the conversation through the contact section and we can establish a suitable next step.
No review or testing strategy can prove the absence of every possible defect. We define scope, choose methods appropriate to the system, report evidence and limitations, and provide practical findings or remediation guidance. Our approach is designed to reduce uncertainty—not to promise absolute security. See how we validate engineering work.
Have a difficult technical problem?
Share the goal, the constraint, or the behaviour you cannot explain. We will help identify the engineering questions, define a practical scope, and agree on what a useful result should demonstrate.
