[Mamori](https://mamori.xyz/), an automated blockchain value extraction system, has raised $5 million in a seed funding round led by [Blockchain Capital](https://blockchaincapital.com), with participation from [Velocity Capital](https://velocity.capital) and [Web3.com](https://web3.com). Mamori is pioneering a general-purpose pathfinder for detecting and defending against “unknown unknowns”, namely zero-day vulnerabilities in smart contracts and new blockchain-related software.



_"We couldn't be more excited to support Mamori in their vision to make smart contracts more secure via modern advanced fuzzing techniques. By enhancing the developer toolkit, this will enable devs to spot more vulnerabilities earlier in a more scalable way." 

Said Ryan Sproule, investor at Blockchain Capital._

Angel _investors_ include Grigore Rosu, Daniel Lubarov, Alex Watts, Bo Du, Shujia Liang, Micheal Heinrich, Richard Adjei and Antonio Viggiano. 

## What is Mamori?


[Mamori](https://mamori.xyz) is an automated value extraction system optimized for blockchain security and value extraction, colloquially named a ML-enabled pathfinder.


Cyber attacks remain a pestilent issue in crypto, with [over US$2.4 billion in losses attributed to exploits in 2023](https://www.slowmist.com/report/2023-Blockchain-Security-and-AML-Annual-Report(EN).pdf). Existing auditing tools and methodologies, derived from historical data, are ill-equipped to meet the preventive security needs of an industry with rapid innovation and billions of dollars at stake.

_“We are very excited about Mamori’ endeavor to identify zero-day exploits by ML-enabled fuzzing to test continuous function input parameters and function sequences. This way, they make smart contracts more secure and more institutions repose confidence in the space, thus facilitating more capital inflow to the on-chain economy, an essential step towards mass adoption!”

Said Richard Yuen, General Partner at Velocity Capital_


Mamori disrupts web3 security with a versatile, future-proof offensive security solution. Its algorithm adapts situationally to extract value from any blockchain-based software, identifying vulnerabilities without any prior knowledge of exploit methodologies(unknown unknowns).


This is achieved through a two-step black-box optimization process involving discrete optimization, continuous optimization, algorithmic parsing, efficient stateful computation techniques, and an innovative feedback mechanism to exhaustively identify value extraction opportunities.




_“I am very excited to witness Mamori's mission to bring advanced ML-integrated fuzzing techniques to smart contract security.  Their automated search and light specification approach form the perfect complement to formal verification!  We are closer than ever to a future where smart contract developers get all the following at the push of a button: Mamori's tools help eliminate programming errors while learning the contract specification, semantics-based formal verification tools prove the program correct wrt the specification, then the correctness proof is ZK-ed and posted on-chain as verifiable evidence.  Programmatically verify, not trust, security audits!”

Said Grigore Rosu, Advisor of Mamori, Professor of Computer Science at UIUC, Founder of Runtime Verification and Founder of Pi Squared._



Mamori identifies both commonalities and unique aspects of value extractions, stemming from the nature of discrete search spaces. This approach has broader applications beyond security, including maximum extractable value (MEV) searching and intent solving.



The founder, [Andy](https://x.com/andymooselee), spent his early career in academia focusing ML applications in Economics. He later joined the blockchain space specialized in AMM mechanism design and found security is the major roadblock of crypto mass adoption. He innovates on the methodologies leveraging interdisciplinary knowledge to create a Pathfinder for Blockchain Value Extraction. Sometimes for his leisure, he loves Jazz, dance and chess.


[Mamori](https://mamori.xyz) plans to expand its team to iterate and optimize its architectural framework. The team leverages insights from academia and Web2 extensively, and invites top talent and projects to collaborate and drive progress together.
To stay updated with Mamori, follow them at [x.com/mamori_xyz](https://x.com/mamori_xyz)


### About Mamori
[Mamori](https://mamori.xyz) is a ML-enabled pathfinder for blockchain value extraction, that can be applied to zero-day economic exploits, MEV search and intent solving, addressing the challenges of scalability, automation, exploit detection relevance, and efficacy in the Web3 value extraction landscape. We apply interdisciplinary technologies and protect against the ’unknown unknowns’ vulnerabilities. To achieve this, we leverage algorithmic parsing techniques to establish smart contract sequences, utilize reproducible stateful computation techniques, and incorporate innovative and customizable algorithmic feedback mechanisms.


mamori_blog_cover.jpeg

Mamori has raised $5 million in seed round led by Blockchain Capital.

Mamori raises $5M to build ML-enabled Pathfinder for blockchain value extraction, led by Blockchain Capital

# Mamori's Thesis 
The problems we see in the current space are: 
1. Security is the roadblock of Crypto Mass Adoption. Current Web3 space is like a Lego block and projects built on top of the project. In the event of a single broken foundation, we will see a systematic collapse. 
2. Current security auditing techniques are insufficient. Most of them learn from the past and protect the future. Thus, existing techniques audit the innovations with past experience. 
3. We have not sufficiently leveraged knowledge outside our space

## The solutions of Mamori: 
1. Interdisciplinary knowledge is applicable to Web3. We are applying Web2 methodology into Web3 such as optimization algorithms and current Web2 fuzzing logic. This is similar to Zero-Knowledge Proof existed back in the 1980s but people widely use it on Web3 now. 
2. We can see value extraction as a tractable optimization problem and we have designed a whole architecture for execution.

# What is the pathfinding process happening from behind? 
For an automated smart contract auditing tool:
1. Upload smart contract(s) in the system
2. Algorithmic parser extracts ‘state-changing’ functions.
3. Given these functions, we solve a discrete optimization problem for sequence invocation. 
4. Given each sequence, we solve a continuous optimization problem for finding parameters. This is an iterative process that parameters at each iteration learn from each other and from the past iteration to exhaust the space more effectively. 
5. The system exports the sequence with corresponding parameters that provide value extraction. 

# How are you sure your solution works? 
We proved several things leveraging Swarm intelligence. 
1. The combination of parameters for exploitation is not a single solution. Our algorithm effectively finds new combinations of parameters to extract value. 
2. Each algorithm needs to pre-define initial bounds at the beginning. Our algorithm can search beyond initial bounds. 
3. Exploits are highly convoluted and some are repeated for loop actions. We prove that discrete search space is reducible as in a process of dimensional reduction.
4. Some exploits involve multi-block transactions and manipulation of the state. We prove that multi-block exploits can be reduced to a single block since it’s about the smart contract state as an exploit pre-requisite.

# Does this one algorithm win over all other alternatives in all sense?
No. We believe there is no one single perfect solution especially for the convoluted nature of exploits. Some could be more efficient in some case. For instance, exploits like saddle finance with 2 steps in the exploitable sequence. Gradient descent with re-initialization techniques could potentially be more efficient than particle swarm optimization (both are effective). The coming research process will fine-grained our algorithmic libraries with even more in-depth details from the web2 literature to build a more comprehensive system.  

# What does it mean by Bug Oracle? 
We are not referring to the Price Oracle in this background. In the security literature, bug oracle means invariant. i.e. Condition to be broken. 

# Would it be time intensive to try all possibilities in the smart contract? 
That is the main reason why we are doing discrete optimization instead of brute forcing. For example, we can look at the relationship between each function by looking at their read-write storage slot. Details refer to the whitepaper. For continuous search space, apparently it is not possible to brute-force because of the huge search space and we use a learning-based approach for continuous optimization. 

Also, apart from chasing time efficiently from the algorithmic perspective, we are open to the possibility of building a decentralized computation network if it's more cost efficient. Decentralized computing in terms of action sequence, since the functional form of each sequence should be different and thus every sequence is independent from each other. 

# Are you running the optimization on-chain?
No. Running on EVM doesn’t mean running on-chain execution. Our first step starts from a cold cache. Once it’s cached the blockchain information (initial state), Our off-chain simulation is executed on our cloud architecture. We access the on-chain data and use techniques such as caching to enhance simulation speed. 

# Do you only cover EVM smart contracts?
We simply start from EVM as it is the most adopted smart contract platform. According to [Defillama](https://defillama.com/), as of July 2024, 89.42% of the TVL in DeFi is on EVM-compatible chains. While we currently specialize in EVM, we have the capability to extend our simulations to other VMs with further integration.

# Do we need to do constant on-chain scanning to make a smart contract secure?
No. The core difference between the present block and the future block is the state. And the state in smart contracts is changed by functions and parametersTherefore, the method we are doing is to exhaust the state by functions and parameters. That’s how we can protect the ‘unknown unknown’ vulnerabilities and innovations.. 

# Any plan for decentralizing the technology? 
Yes. We will build a decentralized Algorithmic-Agent Network catering for a more generic kind of value extraction. Agent is seen as action behaviors with certain attributes and algorithms define the search behavior in the iterative process. We can incentivise decentralized developers on agent contribution with a more competitive and collaborative architecture. Apart from algorithmic contribution, we are currently compatible with EVM. For longer term development, we can incentivize decentralized builders to integrate Mamori to different vm and language. 

The fundamental principle of the Algorithmic-Agent Network is to divide and conquer tasks in value extractions, e.g. Exploits, MEV and Intent. I will definitely write more about this!



Mamori.xyz_Blog.jpg

Mamori.xyz is a smart contract auditing tool with Machine learning Tech. 

What is the pathfinding process happening from behind?

Does this one algorithm win over all other alternatives in all sense?

Would it be time intensive to try all possibilities in the smart contract?

Are you running the optimization on-chain?

Do we need to do constant on-chain scanning to make a smart contract secure?

Any plan for decentralizing the technology?

Latest Articles

Mamori raises $5M to build ML-enabled Pathfinder for blockchain value extraction, led by Blockchain Capital

Introducing Mamori - the ML-enabled Automated Value Extraction System for Exploits, MEV searching and Intent solving