{"id":17611,"date":"2023-11-29T22:09:04","date_gmt":"2023-11-30T03:09:04","guid":{"rendered":"https:\/\/demo2.dedicatedhost247.com\/crypto\/smart-contract-audits-cybersecurity-cointelegraph-magazine\/"},"modified":"2023-11-29T22:09:04","modified_gmt":"2023-11-30T03:09:04","slug":"smart-contract-audits-cybersecurity-cointelegraph-magazine","status":"publish","type":"post","link":"https:\/\/demo2.dedicatedhost247.com\/crypto\/smart-contract-audits-cybersecurity-cointelegraph-magazine\/","title":{"rendered":"Smart contract audits &#038; cybersecurity \u2013 Cointelegraph Magazine"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div style=\"overflow-x: hidden;\">\n<p><strong>Every day this week we\u2019re highlighting one genuine, no bullsh*t, hype free use case for AI in crypto. Today it\u2019s the potential for using AI for smart contract auditing and cybersecurity, we\u2019re so near and yet so far. <\/strong><\/p>\n<figure class=\"wp-block-image alignright size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" alt=\"TurboToad\" class=\"wp-image-19589\" width=\"392\" height=\"392\" srcset=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo.jpg 1024w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-300x300.jpg 300w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-100x100.jpg 100w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-770x770.jpg 770w\" data-lazy-sizes=\"(max-width: 392px) 100vw, 392px\" src=\"http:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-1024x1024.jpg\"\/><noscript><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-1024x1024.jpg\" alt=\"TurboToad\" class=\"wp-image-19589\" width=\"392\" height=\"392\" srcset=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo.jpg 1024w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-300x300.jpg 300w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-100x100.jpg 100w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/05\/Turbo-770x770.jpg 770w\" sizes=\"(max-width: 392px) 100vw, 392px\"\/><\/noscript><figcaption class=\"wp-element-caption\"><em>AI artwork for the ChatGPT written TurboToad memecoin. (Twitter)<\/em><\/figcaption><\/figure>\n<p>One of the big use cases for AI and crypto in the future is in auditing smart contracts and identifying cybersecurity holes. There\u2019s only one problem \u2014 at the moment, GPT-4 sucks at it.<\/p>\n<p>Coinbase tried out ChatGPT\u2019s capabilities for automated token security reviews earlier this year, and in 25% of cases, it wrongly classified high-risk tokens as low-risk.<br \/>James Edwards, the lead maintainer for cybersecurity investigator Librehash, believes OpenAI isn\u2019t keen on having the bot used for tasks like this.<\/p>\n<p>\u201cI strongly believe that OpenAI has quietly nerfed some of the bot\u2019s capabilities when it comes to smart contracts for the sake of not having folks rely on their bot explicitly to draw up a deployable smart contract,\u201d he says, explaining that OpenAI likely doesn\u2019t want to be held responsible for any vulnerabilities or exploits.<\/p>\n<p>This isn\u2019t to say AI has zero capabilities when it comes to smart contracts. AI Eye spoke with Melbourne digital artist Rhett Mankind back in May. He knew nothing at all about creating smart contracts, but through trial and error and numerous rewrites, was able to get <a href=\"https:\/\/cointelegraph.com\/magazine\/make-500-from-chatgpt-stock-tips-bard-leans-left-100m-ai-memecoin-ai-eye\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ChatGPT to create a memecoin called Turbo<\/a> that went on to hit a $100 million market cap.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">gm \u2615\ufe0f <\/p>\n<p>As someone with zero Solidity proficiency, I had an already efficient smart contract tailored to my own needs by AI.<\/p>\n<p>I dumped <a href=\"https:\/\/twitter.com\/Azuki?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">@Azuki<\/a>&#8216;s smart contract into GPT-4 and had it ask me relevant questions. <\/p>\n<p>Disclaimer: Professional human audits and devs are still important to\u2026 <a href=\"https:\/\/t.co\/K4UGfFC5dp\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">pic.twitter.com\/K4UGfFC5dp<\/a><\/p>\n<p>\u2014 SV (@0xSMV) <a href=\"https:\/\/twitter.com\/0xSMV\/status\/1636290229412970498?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">March 16, 2023<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>But as CertiK Chief Security Officer Kang Li points out, while you might get something working with ChatGPT\u2019s help, it\u2019s likely to be full of logical code bugs and potential exploits:<\/p>\n<blockquote class=\"wp-block-quote\">\n<p>\u201cYou write something and ChatGPT helps you build it but because of all these design flaws it may fail miserably when attackers start coming.\u201d <\/p>\n<\/blockquote>\n<p>So it\u2019s definitely not good enough for solo smart contract auditing, in which a tiny mistake can see a project drained of tens of millions \u2014 though Li says it can be \u201ca helpful tool for people doing code analysis.\u201d<\/p>\n<p>Richard Ma from blockchain security firm Quantstamp explains that a major issue at present with its ability to audit smart contracts is that GPT -4\u2019s training data is far too general.<\/p>\n<p><strong><em>Also read:<\/em> <em><a href=\"https:\/\/cointelegraph.com\/magazine\/use-case-ai-crypto-money-payments\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Real AI use cases in crypto, No. 1 \u2014 The best money for AI is crypto<\/a><\/em><\/strong><\/p>\n<p>\u201cBecause ChatGPT is trained on a lot of servers and there\u2019s very little data about smart contracts, it\u2019s better at hacking servers than smart contracts,\u201d he explains.<\/p>\n<p>So the race is on to train up models with years of data of smart contract exploits and hacks so it can learn to spot them.\u00a0<\/p>\n<div class=\"article-suggest\">\n<p>Read also<\/p>\n<div class=\"article-suggest__items\">\n<div class=\"article-suggest__item\">\n                        <a href=\"https:\/\/cointelegraph.com\/magazine\/make-sure-ethereum-wins-steve-newcomb-reveals-zksyncs-prime-directive\/\" class=\"article-suggest__subtitle display4\"><br \/>\n                            <span>Features<\/span><\/p>\n<p>\u2018Make sure Ethereum wins\u2019 \u2014 Steve Newcomb reveals zkSync\u2019s prime directive<\/p>\n<p>                        <\/a>\n                    <\/div>\n<div class=\"article-suggest__item\">\n                        <a href=\"https:\/\/cointelegraph.com\/magazine\/ethereum-eating-world-only-need-one-internet\/\" class=\"article-suggest__subtitle display4\"><br \/>\n                            <span>Features<\/span><\/p>\n<p>Ethereum is eating the world \u2014 \u2018You only need one internet\u2019<\/p>\n<p>                        <\/a>\n                    <\/div>\n<\/div>\n<\/div>\n<p>\u201cThere are newer models where you can put in your own data, and that\u2019s partly what we\u2019ve been doing,\u201d he says. <\/p>\n<p>\u201cWe have a really big internal database of all the different types of exploits. I started a company more than six years ago, and we\u2019ve been tracking all the different types of hacks. And so this data is a valuable thing to be able to train AI.\u201d<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-race-is-on-to-create-ai-smart-contract-auditor\"><strong>Race is on to create AI smart contract auditor<\/strong><\/h2>\n<p>Edwards is working on a similar project and has almost finished building an open-source WizardCoder AI model that incorporates the Mando Project repository of smart contract vulnerabilities. It also uses Microsoft\u2019s CodeBert pretrained programming languages model to help spot problems.<\/p>\n<p>According to Edwards, in testing so far, the AI has been able to \u201caudit contracts with an unprecedented amount of accuracy that far surpasses what one could expect and would receive from GPT-4.\u201d<\/p>\n<p>The bulk of the work has been in creating a custom data set of smart contract exploits that identify the vulnerability down to the lines of code responsible. The next big trick is training the model to spot patterns and similarities.\u00a0<\/p>\n<blockquote class=\"wp-block-quote\">\n<p>\u201cIdeally you want the model to be able to piece together connections between functions, variables, context etc, that maybe a human being might not draw when looking across the same data.\u201d<\/p>\n<\/blockquote>\n<p>While he concedes it\u2019s not as good as a human auditor just yet, it can already do a strong first pass to speed up the auditor\u2019s work and make it more comprehensive.<\/p>\n<p>\u201cSort of help in the way LexisNexis helps a lawyer. Except even more effective,\u201d he says.\u00a0<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-don-t-believe-the-hype\"><strong>Don\u2019t believe the hype<\/strong><\/h2>\n<figure class=\"wp-block-image alignright size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" alt=\"Illia\" class=\"wp-image-25988\" width=\"443\" height=\"332\" srcset=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-1024x768.jpg 1024w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-300x225.jpg 300w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-770x578.jpg 770w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45.jpg 1280w\" data-lazy-sizes=\"(max-width: 443px) 100vw, 443px\" src=\"http:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-1024x768.jpg\"\/><noscript><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-1024x768.jpg\" alt=\"Illia\" class=\"wp-image-25988\" width=\"443\" height=\"332\" srcset=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-1024x768.jpg 1024w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-300x225.jpg 300w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45-770x578.jpg 770w, https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2023\/11\/photo_2023-11-28_12-50-45.jpg 1280w\" sizes=\"(max-width: 443px) 100vw, 443px\"\/><\/noscript><figcaption class=\"wp-element-caption\"><em>Near founder Illia Polushkin is an expert in both AI and blockchain. <\/em><\/figcaption><\/figure>\n<p>Near co-founder Illia Polushkin explains that smart contract exploits are often bizarrely niche edge cases, that one in a billion chance that results in a smart contract behaving in unexpected ways.<\/p>\n<p>But LLMs, which are based on predicting the next word, approach the problem from the opposite direction, Polushkin says.<\/p>\n<p>\u201cThe current models are trying to find the most statistically possible outcome, right? And when you think of smart contracts or like protocol engineering, you need to think about all the edge cases,\u201d he explains.<\/p>\n<p>Polushkin says that his competitive programming background means that when Near was focused on AI, the team developed procedures to try to identify these rare occurrences.<\/p>\n<p>\u201cIt was more formal search procedures around the output of the code. So I don\u2019t think it\u2019s completely impossible, and there are startups now that are really investing in working with code and the correctness of that,\u201d he says.<\/p>\n<p>But Polushkin doesn\u2019t think AI will be as good as humans at auditing for \u201cthe next couple of years. It\u2019s gonna take a little bit longer.\u201d<\/p>\n<p><strong><em>Also read:<\/em> <em><a href=\"https:\/\/cointelegraph.com\/magazine\/real-ai-use-cases-crypto-no-2-ai-can-run-dao\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Real AI use cases in crypto, No. 2 \u2014 AIs can run DAOs<\/a><\/em><\/strong><\/p>\n<div class=\"subscribe subscribe--inner\">\n<div class=\"container\">\n<div class=\"subscribe__inner\">\n<div class=\"subscribe__content\">\n<p>Subscribe<\/p>\n<p>The most engaging reads in blockchain. Delivered once a<br \/>\n        week.<\/p>\n<\/div>\n<div class=\"subscribe__img\">\n    <img alt=\"Subscribe to Magazine by Cointelegraph Newsletter.\" src=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2022\/10\/reading-copy.png\"\/><noscript><img src=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2022\/10\/reading-copy.png\" alt=\"Subscribe to Magazine by Cointelegraph Newsletter.\"\/><\/noscript>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"author category_page\">\n<div class=\"author__img\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" alt=\"Andrew Fenton\" height=\"300\" width=\"300\" src=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2022\/03\/Andrew-Fenton-New-CT-Headshot-1024x1024.jpg\"\/><noscript><img loading=\"lazy\" src=\"https:\/\/cointelegraph.com\/magazine\/wp-content\/uploads\/2022\/03\/Andrew-Fenton-New-CT-Headshot-1024x1024.jpg\" alt=\"Andrew Fenton\" height=\"300\" width=\"300\"\/><\/noscript>\n\t\t\t\t\t\t<\/div>\n<div class=\"author__content\">\n<h2 class=\"author__name\">Andrew Fenton<\/h2>\n<p>Based in Melbourne, Andrew Fenton is a journalist and editor covering cryptocurrency and blockchain. He has worked as a national entertainment writer for News Corp Australia, on SA Weekend as a film journalist, and at The Melbourne Weekly.<\/p>\n<div class=\"author__follow body-l\">\n\t\t\t\t\tFollow the author \t\t\t\t\t\t\t<a href=\"https:\/\/twitter.com\/andrewfenton\" target=\"_blank\" rel=\"noopener noreferrer\">@andrewfenton<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<section class=\"news\">\n<\/section>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/cointelegraph.com\/magazine\/real-ai-use-cases-crypto-3-ai-smart-contract-audits-cybersecurity\/\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every day this week we\u2019re highlighting one genuine, no bullsh*t, hype free use case for AI in crypto. Today it\u2019s the potential for using AI for smart contract auditing and cybersecurity, we\u2019re so near and yet so far. AI artwork for the ChatGPT written TurboToad memecoin. (Twitter) One of the big use cases for AI and crypto in the future is in auditing smart contracts and identifying cybersecurity holes. There\u2019s only one problem \u2014 at the moment, GPT-4 sucks at it. Coinbase tried out ChatGPT\u2019s capabilities for automated token security&hellip;<\/p>\n","protected":false},"author":1,"featured_media":17612,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[34],"tags":[5762,148,2283,6048,130,273],"_links":{"self":[{"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/posts\/17611"}],"collection":[{"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/comments?post=17611"}],"version-history":[{"count":0,"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/posts\/17611\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/media\/17612"}],"wp:attachment":[{"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/media?parent=17611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/categories?post=17611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/demo2.dedicatedhost247.com\/crypto\/wp-json\/wp\/v2\/tags?post=17611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}