I'm building LogicProbe. An AI assisted system for detecting vulnerabilities in modern Solidity smart contracts. I've been building quietly, but today I'm starting to share the journey publicly. Here's what I've built from Day 1 to today 🧵

4 ways to get audit experience with zero clients: • Free audits you ask teams for • Bug bounties, paid or not • Public contests • CTFs Collect your real bugs in one public portfolio. Then message the firms yourself.

✅ [New DualDefense Audit Contest] A fresh challenge just dropped on HackenProof! The DualDefense Audit Contest with @DOI_Ecosystem is now live. Reward pool: Up to $3,000 End Date: October 26, 2026 Scope: Smart contract Last Audit: by @hackenclub Join the contest now! hackenproof.com/audit-progra…

This article is very interesting for designing your own AI tooling for BB hunting: use /goal instead of the attack vector. Use the impacts accepted by the BB program and create a goal around reaching them. Instead of going from attack vector → impact. Try going from impact → attack path. Go from zoomIn instead of zoomOut. blog.trailofbits.com/2026/07…

If I started auditing from zero tomorrow: I wouldn't read more reports. I wouldn't wait for a contest. I wouldn't DM firms. I'd do these 4 things:

Day 8 of Building LogicProbe Today I worked deeper on the hardest part of smart contract vulnerability detection: semantics. A simple rule like: external call + state write = reentrancy creates too many false positives. So I’m teaching LogicProbe to distinguish: • State changing interactions • Read only calls • Read only calls used for control flow • Persistent storage writes • Reentrancy guards • Call/write ordering I also tested multiline require, assert, if, while, compound conditions, and caststyle ERC20 calls. the regression tests passed the goal isn't just to build a model with a good score. the goal is to build a system whose security evidence actually makes sense to a human auditor Still building

Day - 7 Back to building after being offline for a couple of days because I was on transit. What I have achieved so far today for the LogicProbe — AI Business Logic Vulnerability Detector. Continued Phase 2B reentrancy research and built V4.7 as a controlled development experiment. 🔹 Improved nested Solidity storage-write detection 🔹 Detected previously missed nested mapping writes 🔹 Filtered obvious read-only calls like balanceOf() from reentrancy interaction signals 🔹 Ran targeted regression tests across 5 reviewed cases 🔹 Ran the full 2,395 contract Solidity 0.8 compatible development population 🔹 Kept the frozen V4.6 baseline untouched Current V4.7 inventory: • 2,395 contracts • 134,918 functions analyzed • 324 records with persistent writes • 252 records with guards • 0 source records missing Indeed the these numbers are detector evidence, not proof of improved vulnerability detection. One step at a time... LogicProbe continues.....

🚨SOLIDITY-AUDITOR V4 IS NOW OPEN SOURCE (MIT LICENSE) A single command now gets up to 85% recall on High severity findings from multi-week contests from last year. This used to cost protocols tens of thousands - we made it FREE, so any dev can build more safely. by PAG team🫡

给 Claude 注入特定的 SKILL.md，它就能从普通的聊天助理，变身精通 SQLi、EDR 绕过和漏洞挖掘的红队专家。 近期在 GitHub 斩获 6.2k Stars 的开源项目 claude-red，专门为 Claude 建立了一个“进攻性安全技能库”。它通过结构化的提示词文件，让 AI 掌握深度的渗透测试方法论。 核心特征： • 78 个独立技能，覆盖 23 个安全领域：包含 Web 应用渗透、Active Directory 滥用、无线安全、甚至底层的漏洞开发（ROP、堆栈破坏）和容器逃逸。 • 即插即用，按需加载：每个技能都是独立的 SKILL.md。可直接配合 Claude Code 命令行使用，或拖入 Claude 的 Project 中作为 System Prompt，不会浪费多余的上下文。 • 专业操作员视角：内容摒弃了通用科普，专注于具体攻击面的技术细节、特定工具链的使用、边缘用例和提权路径指引。 对于安全研究员、Bug Bounty 猎人或红队人员来说，这相当于给 AI 装备了细分领域专家的知识库，直接将其转化为实战分析辅助工具。 github.com/SnailSploit/claud…

Day 6 building LogicProbe today was about something more important than training a model: trusting the data. i completed a 60 contract manual review of the arbitrary send vulnerability category. results: • 60 reviewed • 2 confirmed access control cases • 58 not access control • 0 unresolved the key lesson: an upstream vulnerability label ≠ automatically the same vulnerability class in my dataset. so arbitrary send → access control remains REVIEW, not AUTO. i also froze the 420 record population and sampling artifacts. i am building LogicProbe one experiment at a time i ve started finding it funny and curious building a model

It's an increasingly common take that AI hacking means cybersecurity is doomed. I disagree. I think cybersecurity is naturally defense-favoring once people get their shit together. And anyone who continues to hold cryptocurrency (including me, ~90% of my net worth) is implicitly making that bet. Here's why I am making that bet. First, the oversimplified punchy one-line statement: If AI can prove Navier-Stokes and FLT, then AI can prove the statement "this program is secure" as a mathematical theorem. Even if the program is very complicated. Now, the nuance: (See also: vitalik.eth.limo/general/202… ) The word "secure" is hiding all kinds of skeletons in the closet in terms of what it actually means. What does it mean for Signal (the encrypted messenger) to be "secure"? The most basic definition you might think of is: no one who doesn't hold the recipient's secret key can read the contents of the message. But: * Did you remember to include _other_ critical forms of security? Can the adversary forge messages? Can the attacker prevent messages from reaching the recipient? Can they cause your client to crash by sending malformed messages? * Have you made sure that your model of the adversary includes attackers that interfere with the protocol actively and not just passively? And attackers that interfere by replaying messages to you or the recipient that either of you sent over the wire at any point earlier? * What if the adversary hacked (or _is_) the Signal server? * How did you learn which public key belongs to the recipient in the first place? What if that process was tampered with? * What if your device gets hacked at some point in the past or future - is your message still safe then? * What if your key leaks because of a bug in your operating system? Or because you got a bugged version of the Signal client? Or what if the database is corrupted? * Or the libraries, interpreter or compiler of the programming language you wrote it in? * What if your key leaks because tiny perturbations in perceptible signals generated by the hardware leak mathematical relationships that can extract the key a few hundredths of a bit at a time? * Are you hiding the *size* of the payload? Does that matter? * You're definitely not hiding the identity of the sender and the recipient, and the exact time each message was sent (think: not just time-of-day, but also time deltas between one message and the next). Is that not enough to deduce a lot of important facts about what relationships you have, and what *kinds* of conversations you are having? So ... even definitions can be over a thousand lines of code, and need deep careful thought to figure them out. Working on making definitions more human-readable is of extreme importance - it's perhaps the only "high-level language" that matters right now. But even still, even despite all of the above, for security-critical components, the definition is a much smaller attack surface than the implementation. Verifying that the definition is adequate is a much more tractable task than scanning over the code directly - and can become even more tractable with better tooling. Definitions are also _additive_: if two groups have two different definitions A and B, then, well, you can just prove that the program satisfies both A and B. Code is not additive in this way: if a program is A + B, a bug in A _or_ B can sink the whole thing. Definitions are additive. And if you can't satisfy A and B at the same time, you've isolated the most important philosophical issue for your project to spend its next few weeks grappling with. Sometimes, definitions are not much smaller than the implementation - UI components might be one example. But for many of the most critical components - message-passing protocols, sandboxes, cryptography like SNARKs and FHE - the asymmetry is real. Historically, a large class of failures with this approach have come from people only verifying a small portion of their code, that they self-declared to be the security-critical portion, and ignoring the rest - and it turns out that something in the rest of the code is security-critical too. This was reasonable back when verification was difficult and scarce. The solution today: sorry, you have to verify over literally your entire program, including database, networking, any caching layers, everything. Modern AI can do it. So it's not about "the good guys find all the vulnerabilities before the bad guys do" - that could maybe work too, after all a finite program only has a finite number of vulns, but it's riskier - it's specifically an asymmetric strategy of making code that is much more resilient in the first place. This is the kind of direction that Ethereum is going in for the next few years. There is no future for blockchains - especially blockchains with scalability and privacy - without doing this. We need to make software actually secure. And we have already made a lot of progress.

Day 5 of building LogicProbe Today I did something that sounds simple but is actually critical in vulnerability detection: Labels. I started reviewing upstream SWC 104 findings for my Solidity dataset. And I found something important: An upstream vulnerability label ≠ automatically a valid LogicProbe label. Some SWC 104 findings were genuinely unchecked external calls. Others were: • try/catch handled calls • internal function calls • return values that were actually captured and used • annotations that needed more context So instead of blindly importing the labels, I'm manually validating them. 27 SWC-104 findings reviewed. Result: 18 confirmed positives 9 confirmed negatives 0 unresolved This is making one thing clear: Good security ML starts with good ground truth. Tomorrow, we continue

I'm 23. For years, I was scared of auditing Solana & Rust. Learn from my mistake. How going deep on Solana changed everything:

LogicProbe #Day 4 v0.6 is officially frozen. Today I started Phase 2: Dataset Expansion & Independent Evaluation. The goal is simple: make the experiments more rigorous, not just make the numbers look better. So far: → Documented the Phase 2 dataset protocol → Reviewed SmartBugs Curated → Found it is primarily Solidity 0.4.x, so it won't enter the primary 0.8.x dataset → Started reviewing a much larger vulnerability dataset → Added provenance, deduplication, leakage control & independent-test rules to the methodology → Currently downloading the dataset through Git LFS One important lesson: A bigger dataset ≠ a better dataset. For LogicProbe, I care about ground truth, diversity, provenance and genuinely unseen evaluation data. Slowly building. Carefully testing. Next → expand the dataset, establish the development/validation split, and protect the independent test set. #Solidity #SmartContracts #Web3 #CyberSecurity #MachineLearning #BuildInPublic

🚨 Web3 security researchers, STOP SCROLLING. This entire playlist is FREE. 8 deep dives into auditing, stateful fuzzing, formal verification, L2 + bridge security, ZK circuits and more. This is hours of serious security education. SAVE IT. youtube.com/playlist?list=PL…

Day 3 of building LogicProbe🔐 Today I moved from feature engineering to actually testing whether the new features help. Built and evaluated LogicProbe v0.4: • 50 Solidity contracts • 32 structural features • 4 vulnerability labels • Random Forest baseline • 80/20 train-test split The result: Hamming Loss: 0.175 → 0.100 Biggest improvement: External Call Handling F1 0.00 → 0.67 Reentrancy F1 0.50 → 0.67 But the interesting part wasn't the score. I performed error analysis and found 4 remaining mistakes. One showed that my current feature extractor doesn't fully understand external calls hidden inside internal helper functions. Another showed that detecting the presence of access control isn't the same as detecting broken access control. That's exactly what I wanted to uncover. Next: turn these failure cases into hypotheses for v0.5. Building, testing, breaking, learning. #Solidity #SmartContractSecurity #MachineLearning #Web3 #AI #BuildInPublic

Full build + code below: 0xasen.xyz/build-your-first-…

LogicProbe — Day 2 🔬 First ML baseline is running. 50 Solidity contracts → 32 features → 4 vulnerability labels → Random Forest. The interesting part wasn't the accuracy. Error analysis revealed that some regex-based contextual features don't reliably capture call → state change ordering. So I'm improving the representation before touching the model. That's the research #Solidity #SmartContractSecurity #AI #ML #Web3