> For the complete documentation index, see [llms.txt](https://whitepaper.gopluslabs.io/goplus-network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.gopluslabs.io/goplus-network/web3-security/deepscan.md). # GoPlus DeepScan ## Overview GoPlus DeepScan is the AI-powered smart-contract security product within the GoPlus Web3 Security product line. It helps projects, developers, launchpads, exchanges, wallets, and communities evaluate token and application contracts before users or agents are exposed to risk. By combining Graph-IR static analysis, AI-driven semantic review, dynamic fuzzing, financial risk modeling, and GoPlus' accumulated security rule patterns, DeepScan produces professional security reports with fast delivery, and keeps assessing contracts after they go live. DeepScan extends GoPlus Web3 Security from transaction protection into contract-level security across the full lifecycle: pre-deployment self-check, audit around launch, and continuous monitoring in production. It is built on the idea that security assessments should evolve alongside the contracts they protect, rather than ending once an audit has been completed. ## Why Point-in-Time Audits Are Not Enough Tokens and DeFi contracts are one of the most common entry points for Web3 users and, increasingly, for AI agents. A contract can look simple from the outside while hiding privileged functions, transfer restrictions, minting risks, proxy upgrade risks, or mechanisms that can drain liquidity or prevent users from selling. Traditional audits are expensive, slow, and hard to access for early-stage projects, and they have four structural limitations: * An audit only reflects the code and operating environment reviewed at that moment. Subsequent upgrades or configuration changes can alter a protocol's risk profile. * New vulnerability classes emerge after the review is complete, leaving audited contracts exposed to techniques that were not understood at the time. * Contracts depend on external infrastructure such as oracles, bridges, and other protocols, whose security can deteriorate independently of the audited code. * Older contracts, including previously audited ones, are increasingly rediscovered and exploited with the assistance of AI, which is lowering the cost of vulnerability discovery for attackers. DeepScan is designed to make contract security faster, more accessible, more intelligence-driven, and continuous. ## Contract Lifecycle Coverage DeepScan extends security across three stages: * **Token Security Self-Check:** A fast initial screen before deployment that identifies common risks quickly. * **AI Contract Audit:** A deeper assessment around launch covering source code, permissions, and business logic. * **Continuous Security Monitoring:** Ongoing reassessment once the contract is live, tracking newly identified vulnerabilities and evolving attack patterns that could affect the application over time. Rather than replacing traditional audits, DeepScan complements them by turning security from a one-off assessment into a continuing process. ## Core Capabilities ### Smart Contract Vulnerability Detection DeepScan detects common smart contract vulnerabilities, including reentrancy risks, integer overflow or underflow, unchecked external calls, unsafe logic, and other structural flaws that may harm users or projects. ### Rug Pull Risk Detection DeepScan identifies mechanisms that can be used to drain funds or undermine user trust, including hidden mint functions, ownership risks, proxy upgrade dangers, privileged liquidity controls, and unsafe administrative permissions. ### Access Control Analysis DeepScan audits privileged functions, admin roles, multisig requirements, ownership status, and role-based access patterns to uncover centralization and abuse risks. ### Honeypot and Scam Detection DeepScan detects hidden transfer restrictions, sell blockers, trading traps, malicious token behavior, and known scam patterns that may prevent users from exiting positions. ### AI-Powered Semantic Audit DeepScan uses large language models to improve semantic understanding of contract logic, helping identify complex vulnerabilities and intent-level risks that basic static rules may miss. ### Financial Semantic Modeling DeepScan applies financial scenario modeling for DeFi and tokenomics-specific risks, including fund flow risk, economic attack vectors, liquidity behavior, and token control design. ### Graph-IR Static Analysis DeepScan performs deep static analysis using graph-based and SSA-based representations of smart contract control flow and data flow, modeling how functions, data, and assets move through a contract and enabling structural detection of vulnerabilities and risky logic paths. ### Dynamic Fuzzing DeepScan tests suspected weaknesses under different scenarios and produces reproducible execution paths, so that findings can be verified rather than only flagged. ### Extensible Rule System and Benchmarks Newly identified attack techniques are incorporated into DeepScan's rule system as the threat environment evolves. GoPlus maintains an open-source AI Auditing Benchmark built from real attack incidents, which serves both as a public research resource and as a validation loop for DeepScan, and evaluates DeepScan against external benchmarks for AI-powered smart-contract auditing. ## DeepScan and $GPS DeepScan services are security services consumed from the GoPlus Security Network, and $GPS is the unit in which they settle: * **Audits and self-checks:** Token projects and platforms pay in $GPS or supported payment models for Token Security Self-Check and AI Contract Audit. Supported payment models are routed into $GPS-denominated settlement. * **Continuous monitoring:** Ongoing monitoring is a recurring security service. Monitoring subscriptions settle in $GPS, which makes DeepScan a source of recurring rather than one-off $GPS-settled consumption. * **Agent-originated audits:** As AI agents write, review, deploy, and interact with contracts, they can request DeepScan analysis programmatically. These machine-originated requests are intended to settle in $GPS in the same way as AI Agent Security API calls. * **Supply side:** Analysis capacity and exploit intelligence are produced by Security Compute Layer operators and data contributors who stake and earn $GPS. ## DeepScan in the GoPlus Security Layer DeepScan is the smart-contract and application layer of GoPlus' execution security architecture and complements the rest of the security layer: * **GoPlus Intelligence** provides security data, rule patterns, AI analysis, and on-chain risk intelligence across more than 50 chains. * **SafeToken Protocol and Locker** help projects create and manage tokens with safer templates and liquidity controls. * **Security RPC, infrastructure integrations, and on-chain firewall** protect users when they interact with tokens and contracts. * **GoPlus AI Security** protects AI agents that review, deploy, or interact with contracts before they execute risky actions, and DeepScan continuously assesses the contracts those agents may encounter. * **SafuSkill** secures the skills and code that agents use to interact with contracts. Together, these components form a lifecycle approach to contract security: self-check and audit before deployment, safer issuance and liquidity management, continuous monitoring in production, real-time risk intelligence, and transaction protection during user and agent interaction. ## Use Cases **Token projects** Audit token contracts before launch, identify high-risk design issues, and provide security transparency to users and partners. **Launchpads and listing platforms** Screen token projects before listing or launch to reduce rug pull, scam, and honeypot exposure. **Wallets and dApps** Use DeepScan reports and GoPlus Intelligence to provide clearer token risk information to users. **Exchanges and market data platforms** Evaluate token contract risks before listing, indexing, or surfacing token data. **Live protocols** Subscribe to Continuous Security Monitoring so that newly discovered vulnerability classes and dependency changes are reassessed against contracts already in production. **AI-assisted Web3 development and autonomous agents** Use DeepScan alongside GoPlus AI Security when AI agents help write, review, deploy, or modify contracts, or when agents need to assess a contract before interacting with it. ## Conclusion DeepScan brings AI-powered audit and continuous monitoring into the GoPlus security layer. It helps projects detect contract risks before launch, keeps assessing them after deployment, gives platforms and agents a faster way to screen assets, and turns contract security into a recurring, $GPS-settled service within the GoPlus Security Network.