The problem Soly - AI Coding Assistant solves

Smart contracts on Ethereum are opaque by default. Even when source code is verified on Sourcify, developers, auditors, and users have no easy way to understand what a contract does, how it's structured, or what risks it carries — without reading thousands of lines of Solidity manually.

Soly / Sourcify Contract Analyzer solves this by turning Sourcify-verified contract data into structured, human-readable intelligence:

• Proxy resolution — automatically detects EIP-1967, UUPS, Gnosis Safe, Diamond, and other proxy patterns and follows the implementation
• Storage layout summary — maps on-chain state variables slot by slot from verified metadata
• Dependency audit — identifies OpenZeppelin, Uniswap, Aave, Chainlink and other library families used in the contract
• ABI + signature fingerprinting — extracts all function, event, and error signatures from verified sources
• Audio transcript — generates a spoken-style narration of the contract analysis, making it accessible without reading code
• Multi-deployment target — works as a Python CLI, a Django + Express full-stack app, and a Cloudflare Worker (zero infra, edge-deployed)

The tool uses only Sourcify-verified data — no off-chain assumptions, no LLM hallucination. Every claim is grounded in the verified source bundle.

Useful for: developers auditing unfamiliar contracts, wallets showing users what they're signing, and AI agents enriching on-chain context.

Challenges we ran into

1. Sourcify API field selection
The /v2/contract endpoint supports a fields query parameter, but not all field names are valid. Passing match or creationMatch directly returns a 400 error. We had to discover the correct field names by reading the Swagger spec carefully and testing iteratively before landing on fields=all as the safe default.

2. Cloudflare Worker template string nesting
The Worker serves both server-side logic and the full HTML UI in a single JS file. Nesting template literals inside the outer backtick-delimited HTML string caused syntax errors. We resolved this by converting inner template expressions to string concatenation, keeping the outer template clean.

3. XSS from Sourcify data
Sourcify returns contract metadata fields that could contain arbitrary strings. When we rendered these values into innerHTML in the Worker UI, we introduced a potential XSS vector. We fixed this by adding an esc() helper that uses DOM textContent for safe HTML-escaping before any insertion.