Glider by Hexens: The Code Query Engine for Smart Contract Security at Scale

Glider

Jul 24, 2026

glider-hexens-code-query-engine-smart-contract-security-image

Table of contents

Glider is a code query engine for smart contracts, built by the blockchain security firm Hexens. It turns every verified EVM contract into queryable, graph-based data. Using plain Python queries, researchers can hunt vulnerability patterns across whole blockchains in minutes instead of auditing one contract at a time.

TL;DR: Glider in one minute

  • What it is: a code query engine for smart contracts. You write a short query, it scans the source code of millions of deployed contracts and returns every match.
  • Who built it: Hexens, a Web3 security firm. Glider is made available to the research community through Remedy, Hexens' open-source security platform.
  • The core idea (variant analysis at scale): one vulnerability is rarely unique. The same flawed pattern is usually copy-pasted across dozens of protocols. Glider lets you describe that pattern once and find every contract that shares it.
  • Why it's different: existing tools like Slither and Semgrep analyze one codebase at a time and don't scale to entire chains. Searching a whole blockchain with traditional tooling takes months. Glider does it in minutes, with roughly a tenth of the code.
  • The reach: 32+ EVM chains, 100+ data labels, every verified (source-available) contract on those chains.
  • Two layers: a free research tool (the Glider IDE plus Query Database)for bug hunters, and a productized commercial layer (the Glider API) used by wallets, exchanges, and compliance platforms.

The problem Glider was built to solve

Traditional smart contract security is one contract at a time. An auditor reviews a single codebase, finds a bug, the project fixes it, and that knowledge dies there. Meanwhile the same bug, or a close cousin of it, sits unfixed in forty other protocols that forked similar code.

This is the gap variant analysis addresses: take a known attack vector and systematically find every other place it exists.

A concrete example of why this matters: when Trust Security published a novel denial-of-service bug affecting a single EIP, the same flaw turned out to apply to over thirty projects. By disclosing it across many programs instead of one, the researchers earned $50,000 from 15 protocols off a single root-cause discovery. That is variant analysis paying off manually. Glider is what happens when you make that process programmatic and chain-wide.

One root-cause bug found across dozens of other contracts that share the same flawed pattern, all located with one Glider query The catch is that until recently, variant analysis at scale was practically impossible. Tools like Slither and Semgrep are powerful for a single project, but they were never built to run across an entire blockchain. The amount of time it would take to scan a full chain with existing products is measured in months. That's the limitation Glider removes.

What Glider actually is (the mechanism)

Glider is a code query engine for smart contracts: the same idea as querying a database, applied to deployed code.

Here is what happens under the hood:

  1. It ingests verified contracts. Glider works on source-available (verified) contracts across its integrated EVM chains, not raw bytecode. Working at the source level is what makes its results precise and human-readable.
  2. It converts code into graph-based artifacts. Every contract is parsed into a structured intermediate representation (Glider builds on SlithIR), exposing control flow, data flow, functions, and individual instructions as queryable objects.
  3. You query it with Python. Deliberately, Glider does not invent a new query language. Queries are written in plain Python syntax. That keeps the learning curve short (most researchers learn the basics in about an hour) and lets the framework integrate with external tooling.
  4. It runs at blockchain scale. Instead of pointing at one repo, a query runs against whole chains. Glider scans hundreds of thousands of contracts and returns every match, typically in minutes.

Because of this design, Glider supports both declarative logic (describe the pattern you want) and imperative logic (write arbitrary analysis), and it handles advanced techniques like taint analysis, all while staying readable. A query that takes ~100 lines in other tools often takes ~10 in Glider.

What a query looks like

This is a minimal, real example (adapted from the Glider docs) that finds every contract on-chain that calls selfdestruct:

from glider import *

def query():
    # iterate over all instructions on the chain
    # and find the ones that call selfdestruct()
    instructions = Instructions().with_callee_name('selfdestruct').exec(100)
    return instructions

Glider returns the matching contract address, the contract name, the exact function, and the precise instruction, and highlights it in the source. That same skeleton scales up to far more complex scenarios: cross-function flows, specific access-control patterns, fee logic, reentrancy shapes, and so on.

A short Glider query scanning every deployed contract on-chain and lighting up only the matching ones, in minutes

The Glider stack

Glider isn't a single screen; it's a layered system. Here's the whole thing, from the free research tool to the commercial API.

The Glider stack: a free research layer (IDE, Skills, Query Database, Watcher) above the commercial Glider API with Token Risks, Security and Data

1. Glider IDE: the research workbench (free)

The Glider IDE is a browser-based, REPL-like environment for writing and running queries. It uses the Monaco editor (the same engine behind VS Code). You pick a chain from a dropdown, write your query on the left, run it, and see results on the right.

Notable features:

  • Output types: Contract, Function, Instruction, and Print, each rendered with source code, addresses, and scanner links (e.g. Etherscan).
  • Recent chains: dynamic databases of contracts active in the last 37 days, so researchers can hunt for fresh deployments rather than only historical code.
  • Sharing: any query can be turned into a shareable link, so findings and techniques spread across the community.
  • Built-in resources: an RVSS calculator (a CVSS-style scoring tool adapted for Web3), Vulnerapedia, bug bounty guidelines, and the docs, all in one place.

The IDE is positioned as Hexens' contribution to the security research community: a public good, not a paywall.

2. Glider Skills: write queries with plain-English prompts

Writing a Glider query still means writing a little Python. To remove even that barrier, Hexens publishes Glider Skills, an open Claude/Codex Skill (a packaged set of instructions an AI assistant loads on demand) that generates working Glider queries from plain-English prompts, with no prior experience required. You describe the code pattern you're hunting for in natural language, and the skill produces the corresponding Glider query for you to run. For example, if you spot a bug in one protocol and want to know which other contracts share it, you can describe the flaw in plain English and get back a query that hunts for it across an entire chain, without touching the query API yourself.

Because it's a standard Claude Skill, it works anywhere Skills are supported (Claude.ai, Claude Code, and the API), and it can also be used in Codex. It's openly available at github.com/Hexens/glider-skills. For researchers unfamiliar with the Glider API, Glider Skills cuts the time to write a query from hours to minutes.

3. Glider Query Database: community-owned vulnerability intelligence

This is the part that turns Glider from a tool into a protocol. The Glider Query Database is an open, curated library of queries covering security vulnerabilities, compliance checks, and data labeling.

The logic is simple and compounding: once someone defines a vulnerability as a query, that query lives in the database forever and protects everyone from that point on. Scattered, tribal security knowledge becomes a shared, reusable, queryable asset. You write a pattern once; it secures every EVM chain, indefinitely.

4. Glider Watcher: continuous monitoring of queries

Glider Watcher lets researchers schedule recurring runs of their queries and get notified only when new matching results appear on-chain. Instead of re-running a hunt manually, you set the pattern and let it watch the chain for you. (This continuous-monitoring capability is the conceptual bridge to Glider Monitor, covered in its own dedicated article.)

5. Glider API: the productized commercial layer

Where the IDE serves researchers, the Glider API packages Glider's engine for platforms that need automated, programmatic risk detection. Hexens shipped the MVP in under two weeks in response to client demand.

On AWS Marketplace, Glider is currently offered as three APIs:

  • Token Risk(s) API: a real-time, on-chain token scanner that detects 20+ critical threat vectors in ERC-20 contracts and assigns each token a 0-100 risk score with human-readable explanations. Full contract scans run in under 15 seconds. Detected risks include hidden fees, blacklist functions, blockable transfers, centralized/hidden mint, ETH balance sweep, excessive withdrawal, external calls in transfer, pausable proxies, selfdestruct, transfer time constraints, unauthorized approvals, and upgradeable whitelists. It can run in strict SAST mode or in a Hybrid (AI plus SAST) mode for maximum precision.

Glider's Token Risks API grading an ERC-20 token as high risk from its own code behaviors — hidden mint, blockable transfer, external call in transfer, selfdestruct

  • Security API: 24/7 continuous scanning for subscribed protocols. When a new 0-day surfaces or a new detector is added, Glider instantly rescans affected code and pushes alerts via webhook, Slack, Telegram, or email. A related 1-Day Protection tier lets verified teams upload source code through a secure portal and get alerted within 24 hours when a new exploit matches their contracts, often before attackers find it.
  • Data API: structured access to 100+ semantic labels (ERC-standard detection, proxy detection, DeFi primitives, tokenomics flags, fork tracing, and more) across supported EVM chains.

How Glider compares

Glider sits in the same conversation as Slither, Semgrep, and token scanners like TokenSniffer, GoPlus, and QuickIntel, but it's solving a different-shaped problem.

  • vs. Slither / Semgrep: these are excellent single-codebase static analyzers. Glider builds on the same lineage (it uses SlithIR) but adds what they lack: blockchain-scale execution and a much lower barrier to writing checks. Months of manual chain-wide review collapse into minutes; ~100 lines of detector logic collapse into ~10.

Glider vs Slither and Semgrep: a chain-wide scan drops from months to minutes and a detector from 100 lines to 10

  • vs. token scanners (TokenSniffer / GoPlus / QuickIntel): most token scanners match surface-level patterns. Glider's Token Risks API evaluates actual contract behavior, which is why it catches risks the others miss. In Hexens' own published benchmark of 27 token contracts on Base and BNB (including real-world scams), the gap was stark: Glider flagged 100% of the critical threats, while the competing tools missed between 40% and 75% of the same risks, frequently returning a clean "OK." Where the other scanners did react, they typically produced either a vague "Suspicious Functions" flag, surface-level metadata ("ownership not renounced"), or outright false positives. Glider, by contrast, returned specific behavioral labels: Balance Manipulation in Non-Standard Functions, External Call in Transfer, Blockable Transfer, LayerZero receive/send, Transfer Time Constraints. These are the exact mechanics used in advanced exploits, and Glider flagged them in under 15 seconds per contract. Full benchmark: https://hexens.io/blog/Glider-Token-Risk-Scanning-for-Traders

The honest framing: Glider doesn't replace a manual audit. It scales the parts of security work that should be automated (finding known patterns everywhere they exist) so human researchers can spend their time on the novel, high-judgment bugs.

The numbers

The case for variant analysis is easier to feel in figures than in theory.

  • 74,000+ malicious tokens were launched in 2024, with roughly $9.9 billion lost to scams that year (2025 Chainalysis Crypto Crime Report). 94% of those scams were orchestrated directly by the token deployer. The cost of not checking a contract before interacting with it is, statistically, a question of when not if.
  • The base rates are brutal: roughly 1 in 3 new token launches turns out to be a scam (35-40%), climbing to 80-95% for low-cap / meme tokens and 90%+ for unaudited presale tokens. Audited, top-100 tokens sit under 5%.
  • According to Hexens' own analysis, 86% of the major smart contract hacks of the past two years could have been flagged by Glider before they happened, because the underlying patterns already existed elsewhere and were findable.
  • In Hexens' published benchmark, Glider detected ~2.5x more risks than the next-best solution at a 99.3% true-positive rate.
  • 200M+∗∗inassetssafeguardedthroughGlider,and∗∗200M+** in assets safeguarded through Glider, and **1M+ paid out to security researchers in bounties tied to findings.
  • 32+ EVM chains integrated and 100+ data labels, with Glider's labels integrated into platforms like Etherscan.

Who uses Glider

Glider is already embedded in real products and platforms:

  • CoinStats integrated the Token Risks API ("Glider Token Risk") to give traders a pre-trade risk check across 30+ EVM chains, surfacing security data at the moment of the buy decision, available to CoinStats Degen-plan users on iOS, Android, and web.
  • GetBlock built its Wallet Audit stack on the Token Risks API (its first release) and offers Hexens-powered, Glider-driven risk audits through both an API and a user interface. GetBlock exposes this as its Risk API service, alongside and complementing GetBlock's own Rug Pull Checker.
  • Circle lists Hexens/Glider in its Alliance partner directory, where Glider is positioned as the search and risk layer for deployed contract behavior.
  • Etherscan and other explorers can drop in Glider's risk labels as badge components to warn users directly.
  • Security firms, wallets, analytics platforms, and compliance providers use Glider to label, classify, and monitor smart contracts at scale.

The through-line: any platform that needs to understand on-chain risk faster than a manual review allows can plug Glider in.

Earning with Glider: the Query Database and bug bounties

Glider's open Query Database grew in part through a Security Queries contest that paid researchers for contributing new vulnerability queries. The contest's prize pool was backed by the Ethereum Foundation through its Ecosystem Support Program, as documented in the EF's own Q2 2025 allocation update. https://blog.ethereum.org/2025/07/23/allocation-q2-25

What remains durable is the earning path Glider was built for: use it to find real bugs, then get paid through bug bounties.

The workflow:

  1. Come up with a vulnerability scenario.
  2. Write a Glider query that detects it across chains.
  3. Confirm the matches and write a proof of concept.
  4. Report your findings to bug bounty programs (via Remedy, Immunefi, or directly with the affected projects) for rewards.

Why this is unusually researcher-friendly:

  • Findings are yours. Vulnerabilities you discover with Glider belong to you; Hexens takes no commission on the bounties you earn.
  • Contribute once, protect every chain. A query added to the open Query Database keeps working as a reusable detector across every EVM chain, indefinitely.
  • A real bounty surface exists. Remedy hosts scoped bug bounty programs for names like Scroll, Polygon, PancakeSwap, and Tokemak, and Hexens runs some of the largest security competitions in the space; its latest CTF drew 2,200+ researchers.

What the community says

Independent researchers routinely use Glider to find real, high-severity bugs, and credit it publicly. A sample of their write-ups (each links to the original post):

Findings made with Glider

Reviews and coverage

  • Independent security educator Johnny Time published a full Glider walkthrough built around the same insight at the core of this article: find a bug in one contract, then discover it in dozens of others and disclose to all of them.
  • Glider is listed in Alchemy's Web3 developer tools directory as a code query engine for variant and data analysis across EVM chains.

Glider Monitor

Glider Monitor is Hexens' continuous monitoring layer for deployed protocols. When a new exploit hits anywhere on-chain, it turns the bug into a query and checks whether the same flaw is live in your code, and it maps your dependency graph, so you also see risk inherited from the contracts yours relies on. It picks up where a one-time audit leaves off, treating security as an ongoing process rather than a snapshot at deployment.

FAQ

What is Glider? Glider is a code query engine for smart contracts, built by the security firm Hexens. It converts verified EVM contracts into queryable, graph-based data and lets researchers write Python queries to find vulnerability patterns across entire blockchains in minutes.

Who created Glider? Hexens, a Web3 cybersecurity firm. Glider is made available to the research community through Remedy, Hexens' open security platform, and is also available commercially as the Glider API (including on the AWS Marketplace).

Is Glider free? The research layer, the Glider IDE and the Query Database, is free and positioned as a public good for security researchers. The Glider API is the commercial, productized layer for platforms and is available on demand.

What is a Glider query? A Glider query is a short Python-syntax script that describes a code pattern you want to find. Queries are reusable, can be shared, and can be stored in the open Query Database.

Do I need to know how to code to use Glider? Not necessarily. Glider queries are written in Python, but Hexens also publishes Glider Skills, an open Claude/Codex Skill that turns a plain-English description of the pattern you're looking for into a ready-to-run Glider query. You can start finding on-chain patterns from a natural-language prompt and edit the generated query as you learn.

What blockchains does Glider support? 32+ EVM-compatible chains, including Ethereum, BNB Chain, Base, Arbitrum, Optimism, Polygon, Avalanche, Blast, Linea, Mantle, zkSync/Polygon zkEVM, and many more, with the list still growing.

How is Glider different from Slither or Semgrep? Slither and Semgrep analyze one codebase at a time. Glider builds on the same foundations (it uses SlithIR) but runs across whole chains, returns results in minutes instead of months, and lets you express a check in roughly a tenth of the code.

What is the Token Risks API? A real-time scanner that detects 20+ critical risk vectors in ERC-20 token contracts (hidden fees, hidden mint, blacklist functions, honeypot behavior, and more), assigns a 0-100 risk score, and returns results in under 15 seconds. It's used by wallets, exchanges, and trading platforms, for example CoinStats and GetBlock.

Can I make money with Glider? Yes, through bug bounties. You can use Glider queries to identify vulnerabilities in deployed contracts, then report your findings to bug bounty programs (via Remedy, Immunefi, or directly with the affected projects) to earn rewards. The findings you make are yours.

Can Glider be misused by attackers? Glider's most sensitive capabilities (e.g. mainnet querying) are access-gated precisely because chain-wide vulnerability discovery is powerful. It's built and operated as a defensive, white-hat security tool.

What is Glider Monitor? Hexens' real-time monitoring layer for deployed protocols, it checks live exploits and dependency risks against your code continuously, picking up where a one-time audit ends.

Want to try it? The Glider IDE is at glide.r.xyz, the docs and Query Database live under r.xyz, and Glider's product page and the API benchmark are on hexens.io.

The Exploit Is the Disclosure: Why On-Chain Hacks Spread Faster Than Patches

Glider

Jul 17, 2026

The Exploit Is the Disclosure: Why On-Chain Hacks Spread Faster Than Patches

In web3, the exploit is the disclosure. It starts a race to copy, not to patch. In a couple of weeks we turned 12 live exploits into detecti...