Open Grant Proposal: ODIN-FEVM — Real-Time FEVM Contract Monitoring & Slither-Based Vulnerability Triage

Open Grant Proposal: ODIN-FEVM — Real-Time FEVM Contract Monitoring & Slither-Based Vulnerability Triage

Project Name:** ODIN-FEVM — Autonomous Threat Hunting for Filecoin EVM (FEVM) Contracts

Proposal Category:** Developer and data tooling

Individual or Entity Name:** Individual

Proposer:** Callum Fitzgerald

Project Repo(s):** https://github.com/97smv6rgyk-cmd/odin-fevm-monitor

(Optional) Filecoin ecosystem affiliations:** None

(Optional) Technical Sponsor:** N/A

Do you agree to open-source all work you do on behalf of this RFP under the MIT/Apache-2 dual-license?:** Yes

---

Project Summary

ODIN is an existing, production-running autonomous threat-hunting platform (live on Ethereum since April 2026) that monitors mempools in real time, fetches verified source from block explorers, runs Slither + Mythril automatically, and triages findings through a two-stage AI pipeline (embedding similarity + LLM exploitability scoring).

Filecoin's FEVM has thousands of deployed contracts but no continuous automated security monitoring. Generic EVM tools don't understand Filecoin-specific execution contexts — built-in actor interactions, storage-market-adjacent patterns, and FEVM deployment dynamics differ from L1 Ethereum.

This grant adapts ODIN to FEVM: a dedicated deployment listener, Filfox/Filscan source ingestion, Slither analysis tuned for FEVM patterns, and a 60-day production metrics report. The deliverable is a permanent monitoring infrastructure, not a one-off audit tool.

I am a sole trader and independent security researcher. I built ODIN self-funded (~6 months full-time, £2,000+ personal investment) with no external backing. Production dashboard: https://thewolfsec.com

---

Impact

Problem:** New FEVM contracts sit unreviewed for days while holding user funds or storage-market-adjacent logic. Automated continuous monitoring does not exist at the ecosystem scale.

Solution:** ODIN-FEVM brings the same detect-analyse-triage-alert loop that ODIN runs on Ethereum to Filecoin's EVM layer, with explorer integration and noise filtering tuned for FEVM.

Who benefits:** FEVM developers, audit firms reviewing FVM contracts, Filecoin Foundation security programs, and users relying on FEVM dApps.

Success looks like:** 100+ FEVM contracts scanned in a 60-day production run. At least 3 independent FEVM projects acknowledge ODIN-FEVM outputs in their workflow within 90 days of final delivery.

---

## Outcomes

1. **FEVM Deployment Listener** — detects new contract deployments on Filecoin EVM within seconds; stores metadata + bytecode; fetches verified source when available via Filfox/Filscan.

2. **FEVM Analysis Pipeline** — Slither runs automatically on each new deployment with verified source; normalised JSON findings compatible with ODIN's existing priority filter and triager.

3. **AI Triage Layer** — extend embedding knowledge base with FEVM-relevant incident patterns; filter known Slither false positives specific to FEVM repos; email alerting on critical/high findings.

4. **Open-Source Release + 60-Day Report** — MIT/Apache-2.0 release of the FEVM module; public metrics report covering contracts scanned, severity distribution, top detector classes, false-positive rate.

---

## Development Roadmap

### Milestone 1 — FEVM Listener + Source Fetching

Timeline: Weeks 1–3 after grant approval

**Deliverables:**
- RPC-based FEVM deployment detection (new contract creation events)
- Verified source fetch via Filfox/Filscan with rate-limit handling
- Per-contract metadata storage mirroring ODIN's existing _mempool layout
- Dry-run mode + 7-day retention policy
- Documentation: setup guide, architecture diagram

Funding:** $14,000

---

### Milestone 2 — Slither Pipeline + Normalized Findings

Timeline:** Weeks 4–6

**Deliverables:**
- Automated Slither on every new FEVM deployment with verified source
- findings_normalized.json per scan (ODIN standard schema)
- Integration with existing ODIN priority filter (regex noise reduction)
- Dashboard chain card for Filecoin showing scan stats

Funding:** $16,000

---

### Milestone 3 — AI Triage, Alerting, Open-Source Release + 60-Day Report

Timeline:** Weeks 7–10 + 60 days production run

**Deliverables:**
- FEVM findings ingested into ChromaDB embedding triager
- LLM triager pass with chain=filecoin tagging
- Email alerts on critical/high findings
- False-positive benchmark on 50 historical FEVM contracts
- MIT/Apache-2.0 open-source release of full FEVM module
- **60-day production metrics report** (public Markdown + CSV on GitHub)
- Filecoin forum post summarising findings and impact

Funding:** $18,000

---

## Total Budget Requested

| Milestone | Description | Funding |
| --- | --- | --- |
| 1 | FEVM listener + source fetching | $14,000 |
| 2 | Slither pipeline + normalized findings | $16,000 |
| 3 | AI triage, open-source release, 60-day report | $18,000 |
| **Total** | | **$48,000** |

---

## Maintenance and Upgrade Plans

I will maintain Odin-FeVM for 12 months post-delivery: dependency updates, FEVM hard-fork compatibility, and issue triage within 14 days. Will seek follow-on Filecoin ProPGF or maintenance grant if usage grows beyond initial scope.

---

# Team

## Team Members

- Callum Fitzgerald

## Team Website

- https://thewolfsec.com (production ODIN dashboard—password—protected, access available for reviewers)

## Relevant Experience

Sole trader and independent security researcher. Built ODIN end-to-end over 6+ months: Immunefi fetcher (580+ programs scanned every 6 hours), Ethereum mempool listener (800+ contract deployments detected), Slither/Mythril analysis orchestrator with scan-dir retention, ChromaDB embedding triager, FastAPI monitoring dashboard, production systemd deployment on dedicated Hetzner VPS (32GB RAM, running 24/7 since April 2026).

This is not a whitepaper — the system is live and processing real on-chain data today.

## Team code repositories

- https://github.com//odin-fevm-monitor

---

# Additional Information

Learned about Filecoin Open Grants via filecoin-project/devgrants and FVM Security Toolkit discussion (#2077).

ODIN-FEVM complements (does not duplicate) pure static-analysis toolkits: it adds continuous real-time monitoring of new deployments, which audit tools do not provide. Together with the ecosystem Slither detector work, ODIN-FEVM closes the time gap between deployment and the first review on FEVM.

Contact:** callumfitzgerald2000@gmail.com