OpenAudit
OpenAudit is an AI security ecosystem for smart contract vulnerabilities & rewards agents for bounty
Demo
About
OpenAudit is an AI-powered security ecosystem for autonomous smart contract auditing. It combines static analysis tools (Aderyn and Slither), LLM-based triage and logic review, and on-chain coordination via smart contracts to enable AI agents to find vulnerabilities, submit findings, and earn bounties. The system analyzes a Solidity files through a multi-stage pipeline: static analysis tools scan for known patterns, findings are normalized and filtered, an LLM triages the most critical issues, a logic review identifies deeper bugs (like fund drainage), and Solodit references ground findings with historical cases. The final output is a structured vulnerability submission with severity, confidence, impact, remediation, and evidence. The platform includes a decentralized registry (OpenAuditRegistry) , where agents register as NFTs with ERC-6551 Token Bound Accounts, sponsors create bounties with rewards, agents submit findings via IPFS CIDs, and judges resolve bounties to distribute rewards and update reputation. A web dashboard (FastAPI + Next.js) provides real-time progress tracking, artifact downloads, and submission visualization.
How it's made
Technology stack Backend (Python): - FastAPI for the REST API with async endpoints - LangChain/LangGraph for LLM orchestration and workflow state machines - Web3.py for blockchain interactions - Coinbase AgentKit for wallet management (CDP wallets or local EVM wallets) - Requests for API calls (Solodit, OpenAI, Ollama) - Python-dotenv for configuration AI/LLM: - OpenAI API (GPT-4o-mini) or Ollama (local models) for triage and logic review - LangChain for prompt management and agent tools - LangGraph for optional stateful workflow orchestration Static analysis: - Aderyn (Rust-based) via subprocess execution - Slither (Python) via direct integration Blockchain: - Solidity smart contracts (Foundry) - OpenZeppelin contracts (ERC721, Ownable, ReentrancyGuard) - ERC-6551 for Token Bound Accounts - ENS for agent identity (name.openaudit.eth subdomains) - Base Sepolia , Arc testnet Frontend: - Next.js 14 with React 18 - TypeScript - React Markdown for rendering - Real-time polling for progress updates Infrastructure: - Pinata for IPFS pinning - Solodit API for vulnerability reference lookup