Hello guys, it's joiny time, and welcome to another web Tre security tutorial. If you clicked this video, you're probably wondering if AI is going to replace smart contract auditors and web three security researchers. This is a super important question that I will try to answer in this exact video. And if you are a smart contract auditor that never used AI for the auditing process or doesn't know how AI can help him in competition or audits or security reviews, you've come to the right place. In today's video, I'm going to show you the best tool for smart contract auditors with AI capabilities, and this tool is called Audit Wizard, which we already covered in a previous video. But since then, there are new amazing AI features that are going to change your auditing game completely. In this video, I will show you how to use all these new features that we didn't cover in the previous video. We will try to find a legit high-severity vulnerability using AI from a recent audit contest. Do you think we're going to make it? Let's see.

So without further ado, let's get [Music] started. So, this is the Audit Wizard website. I've already created the previous video about this tool and all its capabilities, so feel free to check it out in the link in the description below. Essentially, this is a tool for smart contract auditors, which has a lot of tools built inside a web application. It's both an IDE, a scanner with AI capabilities, test writing graphs, and so many amazing features. So, in the previous video, I covered some of these features, and since there are so many new features, I'm going to cover them in this video while focusing on the AI capabilities and how they can help us find vulnerabilities in competitions or audits, whether you do it for clients, bug bounties, competitions, you name it. I will show you how to master this tool and get the best out of it. First, you can create a free account by using the link in the description below, a special link to get started with Audit Wizard, and once you get to this page, you can just click

either login or sign up. There are plenty of ways to sign up: by Google, by Ethereum address, by GitHub. If you want Audit Wizard to connect your GitHub and get all your repositories and start auditing a repository, private or public, from GitHub, then you should connect with GitHub now. I already have an account. You can just create an account using single sign-on with all these features or just create a new one. I already have one, so I'm just going to log in to my account. And now that I'm logged in, you can either import new projects or here on the left sidebar, you have existing projects which you can just jump back on. It remembers all your previous projects in the database, in the cloud, all stored and managed for you. So, in this box, you can paste either a smart contract address or a GitHub repository. You can also select the chains to support multiple chains. So, if you're into bug bounty and bug hunting, you can just put this smart contract address, and it's going to fetch it, get a code if it's

verified. Get the state as well. You can see the live state within the tool. We'll see it in a second. You can also explore active contests or bug bounties. If you just want to go and pick a contest or a bug bounty program, you can just go click here, and it's going to clone all the code locally to a new project here on the left sidebar. You don't need to deal with finding the repository, do cloning, and stuff. Everything is going to be here using one click. And of course, they also have cool find the bug challenges. So if you're getting started, this is also something new that I didn't cover in the previous video. You can get started with these find the bug challenges and also explore and try the tool. So just for the sake of the example, let's just pick the most recent active Code Arena contest, Kak Reaking, and we can just click here. It's going to fetch all the code and create a new project for you all the way here with the README, with the tests, with the contracts, and

this is how it looks like. So, now that you are familiar with how to get started with the code, let's use this AR Arena repository. It's an auditing contest that happened in COD Arena in February 2024, and let's see if we can find some issues using this awesome tool, Audit Wizard, and its AI capabilities. So, let's assume you're starting now a competition, and the first thing you're going to do usually is go through the README and read the documentation, read the context overview, learn about the protocol to see the scope, what kind of contracts you're going to audit, what is out of scope, some context. You're going to go through the README, get yourself familiar with a protocol, with a codebase, and then you're going to jump right into the code. So, let's say we're going to go to the source folder, and these are where the smart contracts are located, and just by reading the overview here in the README, you can understand that it's some kind of PVP game, AI Arena on-chain, with some ERC.

1155 tokens over here. We have NFTs, Fighters, and we also have our token, ERC20 tokens. And you know, it's you have some staking functionalities, and you can see here that they use ERC721 and 1155. So, you can get some initial context about the protocol. And now, we want to dive into the smart contract. Let's just take a look here at Fighter Farm. So, this is probably some kind of farming staking smart contract. We can also read the README over here, Arena Fighter NFT. This contract manages the creation, ownership, and redemption of Arena Fighters NFTs. Cool. So, Fighters Farm, including the ability to mint new NFTs from emerging pool or through the redemption of mint passes. So, what can we do? This is so far just a traditional review of an audit contest, but let's see how we can maximize the tools that Audit Wizard offers us to maybe get a better idea of what this protocol is about and how we can approach it to find vulnerabilities. So, here on the right

sidebar. We have a lot of features. So, we have here the AI assistant. We have Scan. We have Test. We have Graph. We have Inspect. And we have Simulation. We don't have time to cover all of these features in this video, but we'll cover more features in other videos. Don't worry. For now, I want to start with the AI assistant, right? So, I want to get some idea about what a smart contract is about, and already you have some questions prepared for you to get started with the AI assistance. So, we can ask this AI assistant anything about this project. For example, Can you briefly analyze and summarize this code for me? What are the security concerns of this project? Which functions change the state of the contract? How does the contract handle user funds? So, these are just example questions, but you can ask any questions that you might have. And I'm just going to start with a basic one. Can you briefly analyze and summarize this code for me? And literally, 5 seconds pass, and we have a summary of the contract name. It inherits these kinds of contracts. It's

still writing it, so let's wait for it to complete. We have the purpose of this contract: manage creation, ownership, and redemption of ARA Fighters. We have all the state over here, all the state variables, mappings, constructor, external functions, ownership transfer, generation increments, state addition, all these external functions that are accessible for users, and some public functions. So, you can continue and ask questions, and don't worry, we will go back to this AI assistant, but this is just the basic use case of this AI assistant. Instead of going and reading all the code to get some high-level overview about this modart contract, which is amazing, it's going to save so much time. Now, let's jump to the scanners, and as you can see over here, we have three scanners built-in: static analyzers. You can just launch Slither on the smart contract, and then you can also click Analyzer and Adder in. So, three static analyzers are going to run simultaneously on your smart contract and find all these low-hanging fruits, all these vulnerabilities. If you are also a developer, this is a must-have.

tool for you just in one click. You find all these low-hanging fruits, your security issues that you can fix right away before you go through a security review. Or if you're an auditor and you're going to create an audit for a client, you want to make sure first that you report all these low-hanging fruits. It's very funny. I don't know why, but H slitter actually found three highs. We don't know. Some of them might be false positives, but it's pretty impressive that we have some highs and mediums over here that slitter was ever able to find. We have analyzer 26 issues, seven lows, 19 others, probably gas optimizations that can be made in this contract, and also othering fund nine low. So just by three clicks, literally 30 seconds, you get so many issues that you can already fix in the smart contract or report to the developers to fix. And now I want to go and explore another smart contract. So let's take a look at a game items smart contract, and I'm going to open here the

AI assistant again and ask him, Can you briefly analyze and summarize this code for me? So we have a summary over here from our beloved AI assistant, and this contract managed game items for AI Arena. Interesting, it has inheritance of ERC 1155. Let's just confirm it. Yes, we see that it inherits this ERC 115 token, and every game item is probably this kind of token. And it has some events: bought item, locked, unlocked. We also have a struct of game item attributes, state variables, constructor, external functions, public functions, private functions, security considerations, and some potential issues. And we already see here that we have some access control and owner and admin, and we have some daily limits and transferability check. So maybe some of the tokens cannot be transferred, and we have some centralization risk. And we have a very initial broad idea about this smart contract, but now we want to take it a step further and try to see if we can maybe find logical issues or security issues in this smart contract. So we understand that these game items are ERC 115 tokens, and we see also there.

are transfer restrictions. So, let's just ask how can new game items be created? How can we create new game items? Who creates them? How does it work, right? So, well, we get an answer, right? So, it has the context, it understands the smart contracts, and it gives us a breakdown overview how new games can be introduced, how items can be introduced to the games, where the function create game item only capable by admins. Okay, so only admins can create new game items, right? And they supply the name, the supply, the URI, transferable. Okay, it's a Boolean indicating if the item can be transferred. So, we already understand that there are some items in this game that cannot be transferred. Look how much context and how much information we already have about the protocol without even reading the smart contract. This is incredible. It's going to save so much time. Items remaining, items price, daily allowance. So, they set some kind of daily meeting allowance, and we have all the steps how the algorithm of creating new items work. And okay, so now I'm in

particular curious about this transferable, so some items cannot be transferred, and I'm wondering how they implemented these transferable configurations. So, let's ask our AI assistant, can you explain a bit about the transfer restriction and how it works, right? So, we are curious like how do they implement this transfer restriction even though we know that IRC 115 tokens by default are transferable. Anyone can transfer tokens, right? So, let's see what we have here. Transfer restriction purpose: control whether game items can be transferred between addresses. So, we have this attribute of transferable in every G item attributes, and we have a function adjust a transferability that overwrites this. A safe, we overwrite this safe transfer from function, which is a built-in function in ear C15 tokens. So, here we have some details. Each game item has a transferable Boolean attribute that indicates if the item can be transferred. We have this function to change the transferability of an item, so we can either define if it's transferable when we create it. That admin defines it, and you can also adjust it. Only the admin.

the owner can call this function and make it either transferable or not transferable. This is the function. It's going to change the attribute. Great. And we have an override, right? So the safe transfer form is a build function in ERC 1155, and we override it probably in the smart contract. We can search for it. There you go. We override the original ERC 1155 function to make sure that the game item is transferable. If it's not transferable, we're going to revert that transaction. Great. Now we understand more how this feature is working, so we can add here also a comment, right? So we can do right-click, we can do go to definition, pick add note, add bookmark note, add finding fold, all code, expand all code, all the IDE features that you are familiar with, with more features, with some extensions that you are familiar with, like comments, but in just way better UX and with these crazy AI tools, right? So we add here a note, overriding original ERC 1155 transfer feature, right? Let's fix the typo, transfer feature. So let's add a

note and now you can see that the note was added, and now you can also add notes through your smart contract or issues if you find them, and eventually, you can convert them to findings and generate reports using this tool. But again, I'm not going to cover this now; I covered it in the previous video that you can check in the description. But that's not enough, guys. Let's see if we can somehow break this transferable functionality. Maybe there is a way to bypass this functionality, and even though the token is not transferable, maybe we can somehow bypass it, right? We want to see; we are exploring different attack vectors, and we want to ask the AI, is there a possible way to bypass the transferable restriction and transfer a token that is configured as not transferable? So, it took a few seconds, and the AI replied, Yes, there are potential ways to bypass the transferability restriction if the contract is not properly secured. Here are some possible vulnerabilities: direct call to save transfer from in ERC 115, which this one

is complete right because we know that it's overriding the original function. So, we cannot just, if we call this safe transfer form function, we have this required check over here, and we won't be able to transfer the token H. We have here another suggestion, approval mechanism. If contract allows sending approvals for all tokens, set approval for all, and approved RS might be able to transfer non-transferable token. Also, not quite correct because, again, the transfer should go through this function, and if it's just approved, it doesn't mean that we can transfer the token. What about this one, ERC 1155 batch transfer? If the batch transfer function, safe batch transfer form, is not overridden with a transferability check, it could be used to transfer non-transferable tokens. What so IRC 1155 also has a safe batch transfer from, but we do not trust AI, right? We always want to verify. We just get ideas by asking the AI. Maybe he just wrote complete, you know, it's just an AI, so we want to validate this kind of thing. And I want to go and search here.

rc115 do gab right. I want to see the actual rc115 smart contract and see if we have this function that the AI assistant is claiming to have: safe batch transfer from. And we actually have it: safe batch transfer from. And it essentially allows you to transfer multiple token IDs and multiple values from/to address with a data. And it's just going to call this internal safe badge transfer from. And it's essentially going to update with acceptance check and eventually transfer the tokens. This is insane. So the AI here found a potential issue because I don't see here an override for this safe badge transfer from. There are no results here. And since we inherit the IRC 1155, this function will be available by default. It's a public function safe batch transfer from, public virtual function, which we can use to transfer these game items even though they're configured to be non-transferable. Looks like a legitimate high critical vulnerabilities. We bypass the transferable configuration of game items, and we are able to transfer non-transferable game items. This is insane. And we even have here a

mitigation suggestion override the safe batch transfer from and add this kind of check require that the items are transferable. So even the AI Assistant gave us recommendation of how we can fix the issue that exist here. This is completely crazy. Now I want to go and check the audit report of this recent audit contest from February 2024 and see if this issue was reported or not. So I would just go to AI Arena. So this is the AI Arena, a finding report that was published on May 2024, a few months ago, actually two months ago, something like this. And we have here some high severity issues. Locked fighter can be transferred, leads to game server unable to commit transactions, and Unstoppable Fighters doesn't sound like our finding. Non-transferable game item can be transferred with game item safe batch transfer PR. Guys, this is a legit high severity issue that this AI tool from AIT wizard was able to find for us from a recent audit competition contest. This is insane, guys. This is insane. So this AI assistant tool was able to find a legit

high in auditing competition that you can right now submit and get paid for, and that actually brings me to the conclusion that AI is not going to replace security researchers, but it's a tool to help security researchers save time, get new ideas, explore new code bases faster, and get new perspectives about vulnerabilities that might exist in the code. So, it's kind of going together, but you do have to use these AI tools to level up your auditing game, and this is the main thing that I wanted to show you in this video: how we use AI within Aid Wizard to find legit high-severity vulnerabilities. But again, I cannot cover all these features because it has so many features, like adding comments, generating reports, opening a whiteboard and starting to draw diagrams to understand better the code base, opening a notepad. We also have graphs, which is another great way to get an idea about all the functions in a high-level H. So, we can do function scope and contract scope, for example. You can just pick a random smart contract like this neuron.

one click here the graph button and generate a graph, and then you're going to have a very nice overview of all the functions, all the interactions between functions, all the calls just built in, so you can get an idea about his contract. So many m have features in the Arsenal of Auditors and security researchers. You can also inspect if it's real-life deployed contracts on train contracts. You can ins page the storage slots. So let's go back to the game items. We can see all the slots, how all the storage layout is going to be implemented on the evm with all the slots, and if it was a deployed smart contract like a back Bounty, you can also see the values on the on-chain. So it's just so many powerful tools for security researchers, either if you're doing competitions, bug hunting, or auditing for clients, for a company. You really have to try and check out this tool. You can use my link in the description below to get started and create your account for free and start using this tool. By the way, I'm

going to create another video in the future to cover this simulation feature, the integration with Ender, and also the AI test, automatic test creation and execution within Audit Wizard. So, if you are a smart con developer, you can just use Audit Wizard to generate unit tests and integration tests for you using AI. These are incredible features and advanced features that I don't have time to cover in this video, but there will be another video in the future, so make sure to subscribe and turn on the notification button. And if you enjoy this video, leave a huge thumbs up for the video. Feel free to ask questions in the comment section below. I hope you enjoyed this video, and I will see you in the next tutorial.

Smart Contract Auditors vs AI: Who's Here to Stay

Smart Contract Auditors vs AI: Who's Here to Stay

Scripts