feat: transform to Web3 monetized SaaS GitHub Action

Author: Maxwell Voss

Dockerfile

@@ -0,0 +1,24 @@
+FROM python:3.11-slim
+
+# Install solc and system dependencies
+RUN apt-get update && apt-get install -y \
+    software-properties-common \
+    git \
+    curl \
+    jq \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install python dependencies
+COPY requirements.txt /app/requirements.txt
+RUN pip install --no-cache-dir -r /app/requirements.txt
+RUN pip install --no-cache-dir web3 slither-analyzer
+
+# Copy the scanner code
+COPY . /app
+WORKDIR /app
+
+# The entrypoint script
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -1,48 +1,55 @@
-# 🛡️ Solidity Security Scanner (AST-Powered)
+# 🛡️ Solidity Security Scanner PRO (GitHub Action)
 
 [![Security Scanner CI](https://github.com/mvmax-dev/solidity-security-scanner/actions/workflows/python-app.yml/badge.svg)](https://github.com/mvmax-dev/solidity-security-scanner/actions/workflows/python-app.yml)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/release/python-3100/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](http://makeapullrequest.com)
+[![Marketplace](https://img.shields.io/badge/GitHub-Marketplace-blue)](https://github.com/marketplace)
+[![Web3 Paywall](https://img.shields.io/badge/Payment-Crypto_USDC-green)](#pro-version--web3-paywall)
 
-An advanced, open-source static analysis and vulnerability detection engine for Ethereum and Base smart contracts. Built for Web3 security researchers, auditors, and protocol developers to proactively identify and remediate critical attack vectors.
+**Automated Smart Contract Audit**, **DeFi Security**, **Web3 GitHub Action**, **Solidity Auditor**, **Smart Contract Security Bot**.
 
-## 🌟 Key Features
-- **AST-Based Analysis**: Deep structural inspection of Solidity code rather than simple regex matching.
-- **False-Positive Suppression**: Advanced validation pipelines to filter out noise and focus on real threats.
-- **Automated Bounty Integration**: Seamlessly hooks into Immunefi, CodeHawks, and Sherlock for threat intel.
-- **Multi-Vector Detection**: Reentrancy, Oracle Manipulation, Flash Loan vectors, and Unprotected Self-Destructs.
+An advanced, open-source static analysis and AI vulnerability detection engine for Ethereum and Base smart contracts. Built for Web3 security researchers, auditors, and protocol developers. 
 
-## 🚀 Quick Start
+Now available as a seamless **GitHub Action** to automatically secure your Pull Requests!
 
-### Prerequisites
-- Python 3.10+
-- Etherscan/Basescan API Keys (for live contract fetching)
+## 🚀 Quick Start (GitHub Action)
 
-### Installation
-```bash
-git clone https://github.com/mvmax-dev/solidity-security-scanner.git
-cd solidity-security-scanner
-pip install -r requirements.txt
-```
+Add the following workflow to your repository to automatically scan your smart contracts on every Pull Request:
+
+```yaml
+name: "Web3 Security Audit"
+on: [pull_request]
 
-### Usage
-Run the scanner against a live contract on Base:
-```bash
-python security_scanner.py --address 0xYourContractAddress --chain base
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Run Solidity Security Scanner PRO
+        uses: mvmax-dev/solidity-security-scanner@main
+        with:
+          # Optional: Specify your wallet address to unlock AI Validation PRO features
+          wallet_address: "0xYourWalletAddress"
 ```
 
+## 💎 PRO Version & Web3 Paywall
+
+The basic `Slither` structural analysis is 100% free. 
+However, **AI Vulnerability Validation** (which suppresses false positives and detects deep logical flaws) is secured behind a decentralized Web3 Paywall.
+
+**To Unlock PRO:**
+1. Send **50 USDC** on the **Base Network** to `0x0000000000000000000000000000000000000000` (Replace with your actual payment address).
+2. Add your wallet address to the `wallet_address` input in your GitHub workflow.
+3. The Action will query the blockchain via RPC. Once payment is verified, the AI Validator automatically unlocks!
+
 ## 🏗️ Architecture
-The system operates in a 3-phase pipeline:
-1. **Ingestion**: `codebase_analyzer.py` fetches and indexes verified smart contract code.
-2. **Detection**: `security_scanner.py` applies high-fidelity detection rules.
-3. **Validation**: `vulnerability_validator.py` cross-references findings to suppress false positives.
 
-## 🤝 Contributing
-We welcome contributions from the Web3 security community! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details on how to submit Pull Requests.
+1. **Ingestion**: Fetches and indexes verified smart contract code.
+2. **Detection**: Applies high-fidelity detection rules (Reentrancy, MEV vectors, Flash Loans).
+3. **Web3 Paywall**: Verifies your subscription via Base RPC.
+4. **AI Validation**: PRO feature that cross-references findings to suppress false positives.
 
-## 📜 License
-This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
+## 🤝 Contributing & Security
 
----
-*Developed by Maxwell Voss | Sovereign Security Intelligence*
+Please see our [Contributing Guidelines](CONTRIBUTING.md) and [Security Policy](SECURITY.md).
+
+## 📜 License
+MIT License - see the [LICENSE](LICENSE) file for details.

action.yml

@@ -0,0 +1,28 @@
+name: 'Automated Smart Contract Auditor Pro'
+description: 'AI-powered smart contract scanner with Web3 validation logic to secure DeFi/Web3 PRs.'
+author: 'Maxwell VOSS'
+branding:
+  icon: 'shield'
+  color: 'blue'
+
+inputs:
+  contract_address:
+    description: 'The smart contract address or file to scan (optional, if omitted it scans the whole repo)'
+    required: false
+    default: ''
+  wallet_address:
+    description: 'Your Web3 wallet address to unlock AI Validation Pro features via crypto payment'
+    required: false
+    default: ''
+  rpc_url:
+    description: 'RPC URL for Base or Polygon to verify the subscription on-chain'
+    required: false
+    default: 'https://mainnet.base.org'
+
+runs:
+  using: 'docker'
+  image: 'Dockerfile'
+  args:
+    - ${{ inputs.contract_address }}
+    - ${{ inputs.wallet_address }}
+    - ${{ inputs.rpc_url }}

entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -e
+
+CONTRACT_ADDRESS=$1
+WALLET_ADDRESS=$2
+RPC_URL=$3
+
+echo "=========================================================="
+echo "🛡️ Starting Automated Smart Contract Auditor Pro"
+echo "=========================================================="
+
+export WALLET_ADDRESS
+export RPC_URL
+
+if [ -z "$CONTRACT_ADDRESS" ]; then
+    echo "Scanning entire repository workspace..."
+    python /app/security_scanner.py --workspace ${GITHUB_WORKSPACE}
+else
+    echo "Scanning specific contract: $CONTRACT_ADDRESS"
+    python /app/security_scanner.py --address $CONTRACT_ADDRESS
+fi

paywall/verify_subscription.py

@@ -0,0 +1,48 @@
+import os
+import sys
+import json
+from web3 import Web3
+
+# Define the expected payment contract (e.g., an ERC20 token or an NFT subscription contract on Base)
+PAYMENT_CONTRACT_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" # USDC on Base (example)
+REQUIRED_BALANCE = 50 * 10**6 # 50 USDC (6 decimals)
+MY_WALLET = "0x0000000000000000000000000000000000000000" # Replace with real dev wallet
+
+# Minimal ERC20 ABI for balance check
+ERC20_ABI = json.loads('[{"constant":true,"inputs":[{"name":"_owner","type":"address"}],"name":"balanceOf","outputs":[{"name":"balance","type":"uint256"}],"type":"function"}]')
+
+def verify_subscription(user_wallet: str, rpc_url: str) -> bool:
+    if not user_wallet or not rpc_url:
+        print("[PAYWALL] No wallet or RPC provided. Access to AI Validation PRO denied.")
+        return False
+
+    try:
+        w3 = Web3(Web3.HTTPProvider(rpc_url))
+        if not w3.is_connected():
+            print(f"[PAYWALL] Failed to connect to RPC: {rpc_url}")
+            return False
+        
+        user_wallet = w3.to_checksum_address(user_wallet)
+        contract = w3.eth.contract(address=w3.to_checksum_address(PAYMENT_CONTRACT_ADDRESS), abi=ERC20_ABI)
+        
+        balance = contract.functions.balanceOf(user_wallet).call()
+        
+        if balance >= REQUIRED_BALANCE:
+            print(f"[PAYWALL] Subscription verified for {user_wallet}. AI Validation PRO unlocked!")
+            return True
+        else:
+            print(f"[PAYWALL] Wallet {user_wallet} does not have the required Pro subscription balance.")
+            print(f"[PAYWALL] Required: {REQUIRED_BALANCE / 10**6} USDC. Found: {balance / 10**6} USDC.")
+            return False
+    except Exception as e:
+        print(f"[PAYWALL] Verification error: {e}")
+        return False
+
+if __name__ == "__main__":
+    wallet = os.environ.get("WALLET_ADDRESS", "")
+    rpc = os.environ.get("RPC_URL", "https://mainnet.base.org")
+    
+    if verify_subscription(wallet, rpc):
+        sys.exit(0) # Success
+    else:
+        sys.exit(1) # Paywall blocked

security_scanner.py

@@ -755,6 +755,29 @@ def scan_contract(contract_address: str) -> None:
         "slither_findings": slither_findings_for_packager,
         "scan_timestamp": datetime.now(timezone.utc).isoformat(),
     }
+    
+    # --- WEB3 SAAS PAYWALL LOGIC ---
+    try:
+        from paywall.verify_subscription import verify_subscription
+        wallet = os.environ.get("WALLET_ADDRESS", "")
+        rpc = os.environ.get("RPC_URL", "https://mainnet.base.org")
+        has_pro = verify_subscription(wallet, rpc)
+    except Exception:
+        has_pro = False
+
+    if has_pro:
+        output["ai_validation"] = "✅ PRO feature unlocked! Running AI Validation..."
+        try:
+            from vulnerability_validator import VulnerabilityValidator
+            validator = VulnerabilityValidator(workspace)
+            val_res = validator.validate_contract(contract_address)
+            output["ai_validation_results"] = val_res
+        except Exception as e:
+            output["ai_validation_error"] = str(e)
+    else:
+        output["ai_validation"] = "🔒 AI Validation is locked. Pay 50 USDC on Base Network to unlock Deep AI Audits."
+        output["payment_link"] = "https://pay.mvmax-dev.org"
+        output["wallet_required"] = "Set WALLET_ADDRESS in Action inputs to verify your subscription."
     sys.stdout.write(json.dumps(output) + "\n")
     sys.stdout.flush()