스마트 계약 감사 프로세스를 혁신하는 AI 도구

### AI로 스마트 계약 감사 강화: 감사 마법사 자세히 알아보기
* 🤖 이 튜토리얼에서는 감사 마법사라는 혁신적인 도구를 중심으로 **AI가 스마트 컨트랙트 감사자와 웹 3.0 보안 연구원을 대체할 수 있을지에 대한 중요한 질문**에 대해 살펴봅니다.
* 🔍 감사 마법사는 스마트 컨트랙트 감사자를 위한 종합 플랫폼으로, **감사 프로세스를 간소화**하도록 설계된 **IDE, AI 지원 스캐너, 테스트 기능**과 같은 도구가 내장되어 있습니다.
* 🛠 지난 영상 이후 새로운 AI 기능이 추가되어 **감사 및 대회 기간 동안 감사자가 심각도가 높은 취약점을 효율적으로 식별**할 수 있습니다.
* 📈 사용자는 **무료 계정을 만들고, 여러 플랫폼을 통해 쉽게 로그인**하고, **GitHub 또는 스마트 계약 주소에서 프로젝트를 가져와 감사 워크플로우를 개선**할 수 있습니다.
* 📝 AI 어시스턴트는 **스마트 컨트랙트 코드를 빠르게 요약**하고, 보안 인사이트를 제공하며, **컨트랙트 상태를 변경하는 기능**을 식별하여 초기 평가에 필요한 시간을 크게 단축할 수 있습니다.
* ⚠ 사용자는 내장된 스캐너를 활용하여 단 몇 번의 클릭만으로 **취약점과 미흡한 부분**을 감지하고 스마트 컨트랙트의 보안 상태에 대한 즉각적인 피드백을 받을 수 있습니다.
* 🔒 또한, AI 어시스턴트는 **ERC 1155 토큰의 전송 제한 우회**와 같은 잠재적인 논리적 문제를 식별하는 데 도움을 주어 중요한 취약점을 발견하는 도구의 능력을 보여줍니다.
* 🤝 궁극적으로 AI는 보안 연구원을 대체하는 것이 아니라 **그들의 역량과 효율성을 향상시키는 강력한 조력자 역할**을 하며, **감사 마법사와 같은 도구는 최신 감사 관행에 필수적**입니다.

AI 도구는 취약점을 식별하고 연구자의 시간을 절약하여 스마트 컨트랙트 감사를 강화합니다.

Hello guys, it's joiny time, and welcome to another web Tre security tutorial. If you clicked this video, you're probably wondering if AI is going to replace smart contract auditors and web three security researchers. This is a super important question that I will try to answer in this exact video. And if you are a smart contract auditor that never used AI for the auditing process or doesn't know how AI can help him in competition or audits or security reviews, you've come to the right place. In today's video, I'm going to show you the best tool for smart contract auditors with AI capabilities, and this tool is called Audit Wizard, which we already covered in a previous video. But since then, there are new amazing AI features that are going to change your auditing game completely. In this video, I will show you how to use all these new features that we didn't cover in the previous video. We will try to find a legit high-severity vulnerability using AI from a recent audit contest. Do you think we're going to make it? Let's see.

So without further ado, let's get [Music] started. So, this is the Audit Wizard website. I've already created the previous video about this tool and all its capabilities, so feel free to check it out in the link in the description below. Essentially, this is a tool for smart contract auditors, which has a lot of tools built inside a web application. It's both an IDE, a scanner with AI capabilities, test writing graphs, and so many amazing features. So, in the previous video, I covered some of these features, and since there are so many new features, I'm going to cover them in this video while focusing on the AI capabilities and how they can help us find vulnerabilities in competitions or audits, whether you do it for clients, bug bounties, competitions, you name it. I will show you how to master this tool and get the best out of it. First, you can create a free account by using the link in the description below, a special link to get started with Audit Wizard, and once you get to this page, you can just click

either login or sign up. There are plenty of ways to sign up: by Google, by Ethereum address, by GitHub. If you want Audit Wizard to connect your GitHub and get all your repositories and start auditing a repository, private or public, from GitHub, then you should connect with GitHub now. I already have an account. You can just create an account using single sign-on with all these features or just create a new one. I already have one, so I'm just going to log in to my account. And now that I'm logged in, you can either import new projects or here on the left sidebar, you have existing projects which you can just jump back on. It remembers all your previous projects in the database, in the cloud, all stored and managed for you. So, in this box, you can paste either a smart contract address or a GitHub repository. You can also select the chains to support multiple chains. So, if you're into bug bounty and bug hunting, you can just put this smart contract address, and it's going to fetch it, get a code if it's

verified. Get the state as well. You can see the live state within the tool. We'll see it in a second. You can also explore active contests or bug bounties. If you just want to go and pick a contest or a bug bounty program, you can just go click here, and it's going to clone all the code locally to a new project here on the left sidebar. You don't need to deal with finding the repository, do cloning, and stuff. Everything is going to be here using one click. And of course, they also have cool find the bug challenges. So if you're getting started, this is also something new that I didn't cover in the previous video. You can get started with these find the bug challenges and also explore and try the tool. So just for the sake of the example, let's just pick the most recent active Code Arena contest, Kak Reaking, and we can just click here. It's going to fetch all the code and create a new project for you all the way here with the README, with the tests, with the contracts, and

this is how it looks like. So, now that you are familiar with how to get started with the code, let's use this AR Arena repository. It's an auditing contest that happened in COD Arena in February 2024, and let's see if we can find some issues using this awesome tool, Audit Wizard, and its AI capabilities. So, let's assume you're starting now a competition, and the first thing you're going to do usually is go through the README and read the documentation, read the context overview, learn about the protocol to see the scope, what kind of contracts you're going to audit, what is out of scope, some context. You're going to go through the README, get yourself familiar with a protocol, with a codebase, and then you're going to jump right into the code. So, let's say we're going to go to the source folder, and these are where the smart contracts are located, and just by reading the overview here in the README, you can understand that it's some kind of PVP game, AI Arena on-chain, with some ERC.

1155 tokens over here. We have NFTs, Fighters, and we also have our token, ERC20 tokens. And you know, it's you have some staking functionalities, and you can see here that they use ERC721 and 1155. So, you can get some initial context about the protocol. And now, we want to dive into the smart contract. Let's just take a look here at Fighter Farm. So, this is probably some kind of farming staking smart contract. We can also read the README over here, Arena Fighter NFT. This contract manages the creation, ownership, and redemption of Arena Fighters NFTs. Cool. So, Fighters Farm, including the ability to mint new NFTs from emerging pool or through the redemption of mint passes. So, what can we do? This is so far just a traditional review of an audit contest, but let's see how we can maximize the tools that Audit Wizard offers us to maybe get a better idea of what this protocol is about and how we can approach it to find vulnerabilities. So, here on the right

sidebar. We have a lot of features. So, we have here the AI assistant. We have Scan. We have Test. We have Graph. We have Inspect. And we have Simulation. We don't have time to cover all of these features in this video, but we'll cover more features in other videos. Don't worry. For now, I want to start with the AI assistant, right? So, I want to get some idea about what a smart contract is about, and already you have some questions prepared for you to get started with the AI assistance. So, we can ask this AI assistant anything about this project. For example, Can you briefly analyze and summarize this code for me? What are the security concerns of this project? Which functions change the state of the contract? How does the contract handle user funds? So, these are just example questions, but you can ask any questions that you might have. And I'm just going to start with a basic one. Can you briefly analyze and summarize this code for me? And literally, 5 seconds pass, and we have a summary of the contract name. It inherits these kinds of contracts. It's

still writing it, so let's wait for it to complete. We have the purpose of this contract: manage creation, ownership, and redemption of ARA Fighters. We have all the state over here, all the state variables, mappings, constructor, external functions, ownership transfer, generation increments, state addition, all these external functions that are accessible for users, and some public functions. So, you can continue and ask questions, and don't worry, we will go back to this AI assistant, but this is just the basic use case of this AI assistant. Instead of going and reading all the code to get some high-level overview about this modart contract, which is amazing, it's going to save so much time. Now, let's jump to the scanners, and as you can see over here, we have three scanners built-in: static analyzers. You can just launch Slither on the smart contract, and then you can also click Analyzer and Adder in. So, three static analyzers are going to run simultaneously on your smart contract and find all these low-hanging fruits, all these vulnerabilities. If you are also a developer, this is a must-have.

tool for you just in one click. You find all these low-hanging fruits, your security issues that you can fix right away before you go through a security review. Or if you're an auditor and you're going to create an audit for a client, you want to make sure first that you report all these low-hanging fruits. It's very funny. I don't know why, but H slitter actually found three highs. We don't know. Some of them might be false positives, but it's pretty impressive that we have some highs and mediums over here that slitter was ever able to find. We have analyzer 26 issues, seven lows, 19 others, probably gas optimizations that can be made in this contract, and also othering fund nine low. So just by three clicks, literally 30 seconds, you get so many issues that you can already fix in the smart contract or report to the developers to fix. And now I want to go and explore another smart contract. So let's take a look at a game items smart contract, and I'm going to open here the

AI assistant again and ask him, Can you briefly analyze and summarize this code for me? So we have a summary over here from our beloved AI assistant, and this contract managed game items for AI Arena. Interesting, it has inheritance of ERC 1155. Let's just confirm it. Yes, we see that it inherits this ERC 115 token, and every game item is probably this kind of token. And it has some events: bought item, locked, unlocked. We also have a struct of game item attributes, state variables, constructor, external functions, public functions, private functions, security considerations, and some potential issues. And we already see here that we have some access control and owner and admin, and we have some daily limits and transferability check. So maybe some of the tokens cannot be transferred, and we have some centralization risk. And we have a very initial broad idea about this smart contract, but now we want to take it a step further and try to see if we can maybe find logical issues or security issues in this smart contract. So we understand that these game items are ERC 115 tokens, and we see also there.

are transfer restrictions. So, let's just ask how can new game items be created? How can we create new game items? Who creates them? How does it work, right? So, well, we get an answer, right? So, it has the context, it understands the smart contracts, and it gives us a breakdown overview how new games can be introduced, how items can be introduced to the games, where the function create game item only capable by admins. Okay, so only admins can create new game items, right? And they supply the name, the supply, the URI, transferable. Okay, it's a Boolean indicating if the item can be transferred. So, we already understand that there are some items in this game that cannot be transferred. Look how much context and how much information we already have about the protocol without even reading the smart contract. This is incredible. It's going to save so much time. Items remaining, items price, daily allowance. So, they set some kind of daily meeting allowance, and we have all the steps how the algorithm of creating new items work. And okay, so now I'm in

particular curious about this transferable, so some items cannot be transferred, and I'm wondering how they implemented these transferable configurations. So, let's ask our AI assistant, can you explain a bit about the transfer restriction and how it works, right? So, we are curious like how do they implement this transfer restriction even though we know that IRC 115 tokens by default are transferable. Anyone can transfer tokens, right? So, let's see what we have here. Transfer restriction purpose: control whether game items can be transferred between addresses. So, we have this attribute of transferable in every G item attributes, and we have a function adjust a transferability that overwrites this. A safe, we overwrite this safe transfer from function, which is a built-in function in ear C15 tokens. So, here we have some details. Each game item has a transferable Boolean attribute that indicates if the item can be transferred. We have this function to change the transferability of an item, so we can either define if it's transferable when we create it. That admin defines it, and you can also adjust it. Only the admin.

the owner can call this function and make it either transferable or not transferable. This is the function. It's going to change the attribute. Great. And we have an override, right? So the safe transfer form is a build function in ERC 1155, and we override it probably in the smart contract. We can search for it. There you go. We override the original ERC 1155 function to make sure that the game item is transferable. If it's not transferable, we're going to revert that transaction. Great. Now we understand more how this feature is working, so we can add here also a comment, right? So we can do right-click, we can do go to definition, pick add note, add bookmark note, add finding fold, all code, expand all code, all the IDE features that you are familiar with, with more features, with some extensions that you are familiar with, like comments, but in just way better UX and with these crazy AI tools, right? So we add here a note, overriding original ERC 1155 transfer feature, right? Let's fix the typo, transfer feature. So let's add a

note and now you can see that the note was added, and now you can also add notes through your smart contract or issues if you find them, and eventually, you can convert them to findings and generate reports using this tool. But again, I'm not going to cover this now; I covered it in the previous video that you can check in the description. But that's not enough, guys. Let's see if we can somehow break this transferable functionality. Maybe there is a way to bypass this functionality, and even though the token is not transferable, maybe we can somehow bypass it, right? We want to see; we are exploring different attack vectors, and we want to ask the AI, is there a possible way to bypass the transferable restriction and transfer a token that is configured as not transferable? So, it took a few seconds, and the AI replied, Yes, there are potential ways to bypass the transferability restriction if the contract is not properly secured. Here are some possible vulnerabilities: direct call to save transfer from in ERC 115, which this one

is complete right because we know that it's overriding the original function. So, we cannot just, if we call this safe transfer form function, we have this required check over here, and we won't be able to transfer the token H. We have here another suggestion, approval mechanism. If contract allows sending approvals for all tokens, set approval for all, and approved RS might be able to transfer non-transferable token. Also, not quite correct because, again, the transfer should go through this function, and if it's just approved, it doesn't mean that we can transfer the token. What about this one, ERC 1155 batch transfer? If the batch transfer function, safe batch transfer form, is not overridden with a transferability check, it could be used to transfer non-transferable tokens. What so IRC 1155 also has a safe batch transfer from, but we do not trust AI, right? We always want to verify. We just get ideas by asking the AI. Maybe he just wrote complete, you know, it's just an AI, so we want to validate this kind of thing. And I want to go and search here.

rc115 do gab right. I want to see the actual rc115 smart contract and see if we have this function that the AI assistant is claiming to have: safe batch transfer from. And we actually have it: safe batch transfer from. And it essentially allows you to transfer multiple token IDs and multiple values from/to address with a data. And it's just going to call this internal safe badge transfer from. And it's essentially going to update with acceptance check and eventually transfer the tokens. This is insane. So the AI here found a potential issue because I don't see here an override for this safe badge transfer from. There are no results here. And since we inherit the IRC 1155, this function will be available by default. It's a public function safe batch transfer from, public virtual function, which we can use to transfer these game items even though they're configured to be non-transferable. Looks like a legitimate high critical vulnerabilities. We bypass the transferable configuration of game items, and we are able to transfer non-transferable game items. This is insane. And we even have here a

mitigation suggestion override the safe batch transfer from and add this kind of check require that the items are transferable. So even the AI Assistant gave us recommendation of how we can fix the issue that exist here. This is completely crazy. Now I want to go and check the audit report of this recent audit contest from February 2024 and see if this issue was reported or not. So I would just go to AI Arena. So this is the AI Arena, a finding report that was published on May 2024, a few months ago, actually two months ago, something like this. And we have here some high severity issues. Locked fighter can be transferred, leads to game server unable to commit transactions, and Unstoppable Fighters doesn't sound like our finding. Non-transferable game item can be transferred with game item safe batch transfer PR. Guys, this is a legit high severity issue that this AI tool from AIT wizard was able to find for us from a recent audit competition contest. This is insane, guys. This is insane. So this AI assistant tool was able to find a legit

high in auditing competition that you can right now submit and get paid for, and that actually brings me to the conclusion that AI is not going to replace security researchers, but it's a tool to help security researchers save time, get new ideas, explore new code bases faster, and get new perspectives about vulnerabilities that might exist in the code. So, it's kind of going together, but you do have to use these AI tools to level up your auditing game, and this is the main thing that I wanted to show you in this video: how we use AI within Aid Wizard to find legit high-severity vulnerabilities. But again, I cannot cover all these features because it has so many features, like adding comments, generating reports, opening a whiteboard and starting to draw diagrams to understand better the code base, opening a notepad. We also have graphs, which is another great way to get an idea about all the functions in a high-level H. So, we can do function scope and contract scope, for example. You can just pick a random smart contract like this neuron.

one click here the graph button and generate a graph, and then you're going to have a very nice overview of all the functions, all the interactions between functions, all the calls just built in, so you can get an idea about his contract. So many m have features in the Arsenal of Auditors and security researchers. You can also inspect if it's real-life deployed contracts on train contracts. You can ins page the storage slots. So let's go back to the game items. We can see all the slots, how all the storage layout is going to be implemented on the evm with all the slots, and if it was a deployed smart contract like a back Bounty, you can also see the values on the on-chain. So it's just so many powerful tools for security researchers, either if you're doing competitions, bug hunting, or auditing for clients, for a company. You really have to try and check out this tool. You can use my link in the description below to get started and create your account for free and start using this tool. By the way, I'm

going to create another video in the future to cover this simulation feature, the integration with Ender, and also the AI test, automatic test creation and execution within Audit Wizard. So, if you are a smart con developer, you can just use Audit Wizard to generate unit tests and integration tests for you using AI. These are incredible features and advanced features that I don't have time to cover in this video, but there will be another video in the future, so make sure to subscribe and turn on the notification button. And if you enjoy this video, leave a huge thumbs up for the video. Feel free to ask questions in the comment section below. I hope you enjoyed this video, and I will see you in the next tutorial.

Smart Contract Auditors vs AI: Who's Here to Stay

JohnnyTime

스마트 컨트랙트 감사에서 AI의 역할: 감사 마법사

감사 마법사 도구는 감사 프로세스를 개선하기 위해 새로운 AI 기능을 제공하며, 스마트 컨트랙트 감사에 AI가 미치는 영향에 중점을 두고 있습니다.

이 도구는 감사자가 취약점을 찾는 데 도움이 되는 IDE, 스캐너, 테스트 작성, 프로젝트 관리 기능을 갖춘 웹 애플리케이션을 제공합니다.

사용자는 무료 계정을 만들고, 프로젝트를 가져오고, 버그 바운티 콘테스트에 참여할 수 있어 스마트 계약 감사자를 위한 종합적인 솔루션입니다.

스마트 계약 분석을 위한 감사 마법사 사용

AR 아레나 저장소는 2024년 2월에 진행된 감사 콘테스트를 위한 것으로, 온체인 AI와 ERC 토큰을 사용한 PVP 게임에 중점을 두고 있습니다.

감사 마법사 도구는 스마트 컨트랙트의 취약점을 식별하는 데 도움이 되는 AI 지원, 정적 코드 분석 및 기타 기능을 제공합니다.

AI 어시스턴트는 코드 요약을 제공하고 프로젝트의 보안 및 계약 기능에 대한 특정 질문에 답하며, 여러 정적 분석기가 동시에 실행되어 잠재적인 문제를 감지할 수 있습니다.

효율적인 스마트 컨트랙트 분석 및 문제 식별

몇 번의 클릭만으로 스마트 컨트랙트의 보안 문제를 빠르게 식별하고 수정할 수 있는 도구가 출시되었습니다.

게임 아이템 스마트 컨트랙트를 분석하면 액세스 제어, 전송 제한, 관리자 전용 아이템 생성 등의 주요 기능과 함께 ERC 1155의 상속을 확인할 수 있습니다.

AI 어시스턴트는 계약의 기능에 대한 자세한 분석을 제공하여 시간을 절약하고 프로토콜을 이해하는 데 유용한 컨텍스트를 제공합니다.

게임 아이템에는 주소 간 전송 가능성을 제어할 수 있는 전송 가능한 부울 속성이 있습니다.

관리자는 전용 기능을 통해 아이템의 양도 가능성을 조정할 수 있는 권한이 있습니다.

스마트 컨트랙트는 ERC 1155의 안전 전송 기능을 재정의하여 전송 제한을 적용하고 전송할 수 없는 아이템의 거래를 되돌릴 수 있습니다.

ERC 1155 토큰 전송의 치명적인 취약점 확인

AI 어시스턴트는 ERC 1155 토큰 전송 기능, 특히 전송 불가능한 토큰의 전송을 허용할 수 있는 안전한 일괄 전송 기능의 잠재적 문제를 파악했습니다.

이 기능을 재정의하고 양도 가능성 검사를 추가하라는 AI의 제안은 합법적인 완화 전략이었습니다.

최근 감사 보고서에서도 이 취약점이 심각도가 높은 문제로 확인되어 중요한 문제를 식별하는 데 있어 AI 도구의 효율성을 강조했습니다.

AI는 보안 연구원을 대체하는 것이 아니라 시간을 절약하고 취약성에 대한 새로운 관점을 제공함으로써 보안 연구원의 업무를 향상시키는 유용한 도구입니다.

지원 마법사는 그래프 생성, 스토리지 슬롯 검사, 온체인 값 분석 등 다양한 기능을 제공하여 감사자와 보안 연구원을 지원합니다.

이 도구는 또한 AI를 사용하여 단위 및 통합 테스트를 생성하는 옵션을 제공하며, 더 많은 고급 기능은 향후 동영상에서 다룰 예정입니다.