SolidEVM

Formation Solidity 🇫🇷 | Développement de Smart Contracts | Serveur Discord

[SolidEVM @solidevm]

@Kisuke755 Real.

[SolidEVM @solidevm]

@IZYCHE_ Yes

[SolidEVM @solidevm]

https://t.co/SA3hcaLpJc

[SolidEVM @solidevm]

https://t.co/7XyIah0izF

[Bloqarl | Zealynx @TheBlockChainer]

I've been using AI for smart contract audits longer than most people in this space.

And the more I use it, the more confident I am that human auditors aren't going anywhere.

Not because AI is bad. It's actually useful. I use it on every single audit I run.

But there's a massive gap between "useful" and "ready to replace humans" — and I don't think enough people who actually do this work are talking about it honestly.

---

Here's what AI is genuinely good at:

Finding known patterns. Common misconfigs. Simple reentrancy. Integer overflow in obvious places. If a bug has been documented before and looks similar enough to the training data, AI will catch it fast.

Think of it as a tireless junior auditor who's read every public audit report ever written. That's valuable. I'm not dismissing it.

---

Here's where it completely falls apart:

Business logic bugs.

These are the vulnerabilities that come from understanding *why* the code was written — not just *what* it does. When a protocol's incentive design creates an edge case that only makes sense if you understand the economics, AI doesn't see it. It's not pattern-matching against known exploits anymore. It's modeling human intent. That's a different skill entirely.

Novel attack vectors.

The most expensive hacks in DeFi history weren't reentrancy. They were things nobody had seen before. AI can't find what it hasn't been trained on. Human auditors think like attackers — they ask "how would I break this?" That adversarial mindset isn't something you can replicate with a language model. Not yet.

Composability risks.

DeFi protocols don't exist in isolation. A vulnerability might only appear when Protocol A interacts with Protocol B under a specific market condition. Understanding those interactions requires deep context about the entire ecosystem. AI looks at one codebase at a time. Attackers don't.

---

The irony is this:

The more I use AI in my audits, the more clearly I can see the ceiling.

It handles the surface. Humans still have to handle everything beneath it.

Fear that AI will replace auditors assumes auditing is mostly about finding known bugs in isolated codebases. It's not. It's modeling systems, understanding intent, thinking like an attacker, and knowing the ecosystem well enough to spot what doesn't fit.

That work is still very human.

---

Will that change? Maybe. Probably, eventually, in some form.

But "eventually" is doing a lot of work in that sentence. Right now, if you're an auditor worried about your job, the threat isn't AI. The threat is auditors who use AI better than you do.

Learn the tools. Use them. Just don't confuse the tool for the skill.

[Pyro @0x3b33]

Web3 auditor salary breakdown:

Junior: $1000 - $2500 a week
Mid: $2500 - $6000 a week
Senior: $7000+ a week

What determines the difference:
- How good you can break the code
- How good you can sell your skills (most people underestimate this)

[pashov @pashov]

Shafu, I love that you are building in web3. Keep believing in the technology - no, AI is not going to take it away from you. Success is possible, trust me, just keep going.

Me and my team of hackers have worked for you and have done a deep security audit, finding and helping resolve drain-level exploits (report is public, so I allow myself to share that). We also try to be available pretty much 24/7 to give security help, whatever happens.

Smart contract auditors are the backbone of any tech, web3 and crypto specially. They have protected all you builders from so many hacks. They are the same guys building these new AI tools nowadays. Their job and purpose is to protect you!

Appreciate smart contract auditors. Even if bash us, we will help. But trust me. The era is not over, it's just starting. And my team, and all our fellow colleague companies (thank you all), are here to march forward🫡

[Jack Sanford 🛡️ @jack__sanford]

https://t.co/OLP7m7iVxD

[A3R4H4M @abrahamonchain]

if you enjoy reading codebases, and finding bugs before attackers do…

you’re my people…

solidity, audits, invariants, edge cases, SR, exploits…

let’s connect and follow each other…

[SolidEVM @solidevm]

@abrahamonchain 100% 👍

[A3R4H4M @abrahamonchain]

If you’re new to smart contract auditing, here’s the reality

AI will not replace you

But auditors who use AI will replace those who don’t

Your goal should not be

How do I compete with AI?

It should be

How do I use AI to become a better security researcher?

[Aashiieee @meowwcodes]

we (audit firm) are actually looking for intern for reach outs .

Pre-requisites: Have some knowledge about Web3 ecosystems and audit marketplace.

I already have a few people I know in mind, if you think you can do better ,DM me

[SolidEVM @solidevm]

@blckhv Encore plus vrai depuis l’explosion des LLMs

[SolidEVM @solidevm]

https://t.co/uqLANN8R26

[pashov @pashov]

"You can have 100 false positives or invalid reports. In bug bounty, you only have to be right once, to get the $3,000,000 payout"

[Jack Sanford 🛡️ @jack__sanford]

I missed this exploit. Really crazy attack vector, including fooling Etherscan.

The number of exploits outside of pure smart contract logic seems to be growing.

This is partially why @sherlockdefi is focused on lifecycle security in addition to point-in-time audits.

[Jack Sanford 🛡️ @jack__sanford]

Ethereum sets a great example when it comes to security.

For all the auditing and internal reviews they do, they still put $2,000,000 up for grabs in a Sherlock audit contest.

And their approach was completely vindicated. 4 Highs were found in the contest!!

These weren't Highs in clients that control 1% of the network. In order to meet the criteria for High, it has to slash, bring down, or split >33% of the network.

And 4 of these vulnerabilities were found in the contest.

Credit to Ethereum for going the extra mile with a $2,000,000 audit contest.

Contests are still the gold standard for security🏅

[pashov @pashov]

🤯A Security Researcher just got paid $3,000,000 for a single smart contract security vulnerability. Biggest payout we've seen in 3+ years.

This certainly was a HUGE hack prevented. BIG win for the whole web3 community, props to the whitehat, Immunefi & the project itself🫡

[pashov @pashov]

$380k for a single bug bounty. Whitehats are winning even in this bear market. It's because they are providing a useful service, that truly matters and makes a difference.

You love to see it, ethical hackers unite⚔️

[Pyro @0x3b33]

The hardest bugs to find aren’t in the code you wrote, they’re in the code you forgot to write.