Prerequisites
- Node.js (>=v16.x)
- Python 3.8+ (for underlying ML model support)
- Docker (optional, but recommended for reproducibility)
Installation Steps
## Clone the repo (pseudo command, check real repo URL)
git clone https://github.com/solidity-ai/solidity-ai-audit.git
cd solidity-ai-audit
## Install dependencies
npm install
## (Optional) Setup Python virtual environment for ML models
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
## Build the project
npm run build
## Run a basic check
node dist/cli.js --target ./contracts/MyAgent.sol
Expected Output
[INFO] Analyzing MyAgent.sol...
[WARNING] Reentrancy risk detected: function withdraw() at line 45
[INFO] Gas optimization: possible storage packing in struct AgentInfo
[INFO] No ERC-4337 compliance issues detected.
If you hit Python binding errors, check your local Python path or consider Docker for environment isolation.
Core Features of Solidity AI Audit
1. AI-Powered Vulnerability Detection
The tool scans Solidity source code or bytecode to highlight patterns matching known smart contract exploits. This includes common issues like reentrancy attacks, unchecked external calls, uninitialized storage pointers, and dangerous approvals.
It uses a trained NLP model to contextualize code flow, going beyond simple pattern matching. This means it can flag subtle bugs that standard static analyzers often miss.
2. Gas and Efficiency Recommendations
Beyond security, it surfaces gas inefficiencies such as redundant storage reads, expensive opcode usage, or suboptimal loop constructs. These insights help save deployment and transaction costs—something I personally scan for before final gaz deployments.
3. Customizable Rule Sets
Users can extend or tune risk thresholds and detection sensitivity with JSON config files. This allows prioritizing false-positive reduction or aggressive flagging depending on dev cycle urgency.
4. Integration Friendly
A built-in CLI and Node.js API facilitate embedding Solidity AI Audit into existing DevOps and CI/CD pipelines. It outputs JSON reports compatible with standard static analysis dashboards.
How Solidity AI Audit Integrates with Your Security Workflow
What I've found valuable is using the tool as a first-pass gate before triggering heavier manual or formal auditing. For example:
- Pre-commit Hooks: Fast local runs catch obvious risks before pushing code.
- CI/CD Pipelines: Automated scans on PRs flag regressions or new issues, combined with smart-contract-ci-cd-pipeline patterns.
- Audit Augmentation: Used alongside Slither or Aderyn static analyzers for cross-validation.
Building a mature security workflow means not putting all eggs in one basket. AI audits can generate candidate findings but should not fully replace manual review or formal verification like Certora.
Example: Running an Automated AI-Powered Audit
Here’s a quick walkthrough of running Solidity AI Audit on a sample smart contract. This contract is an on-chain AI agent wallet built with session keys and spending limits—stuff I’ve often wired up for DeAI applications.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;
contract AgentWallet {
address public owner;
mapping(address => uint256) public spendingLimits;
modifier onlyOwner() {
require(msg.sender == owner, "Not owner");
_;
}
constructor() {
owner = msg.sender;
}
function setSpendingLimit(address agent, uint256 limit) external onlyOwner {
spendingLimits[agent] = limit;
}
function execute(address to, uint256 amount) external {
require(amount <= spendingLimits[msg.sender], "Limit exceeded");
(bool success, ) = to.call{value: amount}("");
require(success, "Call failed");
}
receive() external payable {}
}
Running the audit:
node dist/cli.js --target ./AgentWallet.sol
Expected key findings:
- Warning about unchecked
call return value properly wrapped — good.
- Suggestions for adding reentrancy guard around
execute — classic gotcha.
- Notes on missing events for
setSpendingLimit — impacts transparency.
This is exactly the kind of high-impact check to automate early.
Strengths and Limitations of AI-Driven Auditing
| Aspect |
Strengths |
Limitations |
| Detection Scope |
Finds both known and novel patterns, reduces noise |
May miss low-level bytecode exploits |
| Speed & Automation |
Near-instant feedback for dev cycles |
Can produce false positives/negatives routinely |
| Integration |
Easy CLI and API usage |
Documentation evolving, some edge-case configs buggy |
| Security Assurance |
Good for exploratory checks |
Should be supplemented with manual audits & fuzzing |
AI audits are a powerful augmentation but not infallible. The best I’ve seen is when you combine AI insights with fuzzers like ItyFuzz or formal tools such as Certora.
Security Best Practices When Using AI Audits
Here are concrete tips from real-world usage:
- Do Not Skip Manual Reviews: AI can overlook context-dependent vulnerabilities, such as permission logic flaws or economic attacks.
- Monitor False Positives: Customize rules to reduce noise to a workable level.
- Beware Unlimited Approvals: AI reports beware this pattern; never grant infinite token allowances without spending limits.
- Protect Private Keys: When integrating agent wallets, keep private keys off AI tools — treat audits as static-only.
- Test on Testnets: Run audit-flagged contracts on testnets before any mainnet deployments.
These steps mitigate risks that no automated tool can fully cover alone.
Complementary Tools and Further Reading
To deepen your security pipeline, explore:
Also, keep an eye on zkML / opML experiments for on-chain ML verification.
FAQ: Common Developer Questions on AI-Based Auditing
Q: How do I give an AI agent a wallet safely?
A: Use scoped session keys with explicit spending limits, never share your full private key with any AI tooling. Consider contract-based wallets that support account abstraction standards like ERC-4337.
Q: Can AI audits replace manual code review?
A: No. AI audits catch many common bugs but often miss subtle economic or logic issues. Always combine with manual audit and fuzzing.
Q: Does Solidity AI Audit support all EVM-compatible chains and L2s?
A: Primarily yes, since it analyzes Solidity source, but runtime chain properties (like blocktimes or gas limits) need context awareness handled elsewhere.
Head-to-Head: Slither, SolidityScan, Certora, and ItyFuzz Compared
When I run a smart contract security audit, I never trust a single engine — each tool catches a different class of bug. Static analyzers surface known patterns in seconds, formal verification proves invariants, and fuzzers stumble into the weird runtime states nobody predicted. Here is how I position the four tools I reach for most:
| Tool |
Category |
Best at |
Speed |
False positives |
| Slither |
Static analysis |
Reentrancy, shadowing, uninitialized storage |
Seconds |
Medium |
| SolidityScan |
AI + static SaaS |
Prioritized triage, remediation hints |
Seconds |
Low-medium |
| Certora |
Formal verification |
Proving invariants (e.g. total supply) |
Minutes-hours |
Very low |
| ItyFuzz |
Hybrid fuzzer |
Runtime exploits, state corruption |
Minutes |
Low |
How I layer them
- Slither runs first on every commit — it's free, deterministic, and near-instant.
- SolidityScan adds an AI severity model that ranks findings, so I fix exploitable bugs before cosmetic ones.
- Certora earns its keep when a protocol holds real value and I need a mathematical guarantee, not a heuristic.
- ItyFuzz closes the gap the others miss: it mutates transactions to reach states no analyzer anticipates.
No single tool equals a full audit. In my workflow the AI layer handles triage and prioritization — human review still signs off on every finding.
Hands-On Walkthrough: Auditing an ERC-20 Contract Step by Step
To make an AI-driven smart contract security audit concrete, let me walk through the exact commands I run against a fresh ERC-20 before it ships. This assumes Foundry and Python are already installed.
1. Install the toolchain
pip install slither-analyzer
foundryup
forge install crytic/properties
2. Run the static + AI pass
slither src/Token.sol --json report.json
I feed report.json into an LLM prompt: "Rank these findings by exploitability and propose a fix for each high-severity item." The model clusters duplicates and drafts remediation, which I always verify by hand.
3. Property-based fuzzing
forge test --match-contract TokenInvariant -vvv
I write invariants such as sum of balances equals totalSupply so the fuzzer hunts for states that break them.
4. Triage and re-run
- Patch each high or critical finding.
- Re-run Slither to confirm the warning is gone.
- Add a regression test so the bug never returns.
5. Sign-off
I never treat a green run as "audited." AI accelerates discovery, but I read every flagged line, confirm the exploit path, and document residual risk. The output of this loop is a report a human can defend — not just a passing badge.
Real Vulnerabilities and How AI Detection Flags Them
The value of any smart contract security audit is measured by the bugs it actually catches. Below are three patterns I see constantly, each with the vulnerable code and how an AI-assisted analyzer surfaces it.
Reentrancy
function withdraw() external {
uint256 bal = balances[msg.sender];
(bool ok, ) = msg.sender.call{value: bal}("");
balances[msg.sender] = 0; // state updated AFTER external call
}
Slither's reentrancy-eth detector flags the external call preceding the state write; the AI layer explains the drain scenario and recommends the checks-effects-interactions pattern or a nonReentrant guard.
Unchecked access control
function setOwner(address who) external {
owner = who; // no onlyOwner modifier
}
An AI model cross-references the function against privileged state and warns that anyone can seize ownership — a finding pure pattern-matching often mislabels as low severity.
Unsafe arithmetic assumptions
uint256 price = amount / totalShares; // reverts when totalShares == 0
A fuzzer like ItyFuzz reaches the totalShares == 0 state and triggers the revert; the AI then narrates the reproduction path in plain English.
My rule: every AI finding gets a proof-of-concept test before I call it real. Detection is a lead, not a verdict — the human closes the case.
Conclusion and Next Steps
In my opinion, Solidity AI Audit is a practical addition for devs building complex on-chain AI agents, agent payment protocols, or DeFI instruments wanting automated code scrutiny. It dramatically reduces iteration time by catching many vulnerabilities before pushing to manual review or testnet deployment.
Try setting it up alongside your existing tools like Slither or Aderyn. Customize its rules to your project’s risk tolerance and integrate it into your CI/CD pipeline (see this guide) to maintain ongoing contract security hygiene.
If you want deeper formal verification or exploratory testing, follow it up with Certora or fuzzers like ItyFuzz. Don’t rely on one tool; a layered approach will prevent costly exploits down the road.
Onwards to secure Solidity AI-powered smart contracts!
