AuditCraft v2 is an interactive smart contract security sandbox that teaches developers how to identify and fix security vulnerabilities through hands-on practice.
Key capabilities:
- Real compilation: Paste Solidity code and compile with actual solc via py-solc-x
- Static analysis: 8 vulnerability detectors flag issues with severity grading
- Severity classification: Critical / High / Medium / Low with exact line references
- Remediation guidance: Every finding includes explanation and suggested fix
- Live deployment: Running on cloud VPS at http://142.171.227.166:8000
Users paste code → click Analyze → get real findings with line numbers, severity colors, and fix recommendations.
How AuditCraft Leverages MeDo
AuditCraft is not just a static demo or a simple prompt wrapper. It was significantly updated during the Build with MeDo Hackathon to use MeDo as the orchestration layer for an interactive smart contract security education workflow.
The core idea is to turn smart contract auditing into a guided, multi-agent learning sandbox: a student or builder submits a Solidity contract, and AuditCraft walks through vulnerability discovery, static analysis, AI-assisted review, and structured reporting step by step.
Multi-turn Conversation Architecture
AuditCraft uses a multi-turn workflow where each stage builds on the previous result instead of producing a one-shot answer.
Scenario: a user submits a Solidity contract or contract address, then the MeDo-powered workflow initiates a staged analysis:
Turn 1 — Scanner Agent
- Accepts the contract input.
- Retrieves or normalizes the Solidity source.
- Identifies contract structure, compiler version, functions, modifiers, and external calls.
Turn 2 — Static Analysis Agent
- Runs Slither-style vulnerability pattern checks.
- Looks for common smart contract risks such as reentrancy, unchecked external calls, access-control mistakes, integer/logic issues, and dangerous assumptions.
- Produces raw candidate findings rather than final claims.
Turn 3 — AI Review Agent
- Reviews the static-analysis output.
- Separates confirmed issues from weak signals.
- Explains exploit preconditions, affected functions, and why each issue matters.
- Reduces false positives by checking whether a suspicious pattern is actually reachable or protected.
Turn 4 — Report Agent
- Converts the analysis into a structured audit-style report.
- Includes severity, affected code path, explanation, recommended fix, and educational notes.
- Formats the result so students can understand both the vulnerability and the reasoning process.
This multi-turn design directly supports MeDo's strength as a conversational app builder: instead of a single generated response, AuditCraft creates an interactive analysis pipeline where each agent has a clear responsibility.
Plugin and Tool Integration
AuditCraft uses MeDo as the user-facing orchestration layer while connecting to security-oriented tools and services behind the scenes.
Integrated components include:
Etherscan-style contract retrieval
- Fetches verified contract source or contract metadata when a user provides an address.
- Helps users analyze real-world contract examples instead of only toy snippets.
Slither-style static analysis
- Provides deterministic security checks before AI reasoning begins.
- Ensures the AI review is grounded in concrete analyzer output instead of unsupported guesses.
Multi-model AI review interface
- Supports deeper reasoning over candidate findings.
- Helps translate low-level static-analysis output into human-readable educational explanations.
Structured report generation
- Turns findings into a professional audit-style format.
- Makes the output useful for learning, demos, and portfolio review.
Full-stack Generation with MeDo
MeDo helped shape the full application workflow, not just the final text output.
The hackathon update focused on:
- Designing the user flow for a smart contract security sandbox.
- Prototyping the multi-agent conversation sequence.
- Structuring how scanner, analyzer, reviewer, and reporter stages pass information to each other.
- Creating a user-facing experience where non-security experts can learn how an audit is performed.
- Turning a technical backend concept into an accessible application.
Why This Demonstrates Technical Depth
AuditCraft uses MeDo in a way that goes beyond basic page generation:
Multi-turn reasoning
- The app models auditing as a staged conversation, not a one-prompt answer.
Tool-augmented workflow
- Static analysis and contract retrieval provide evidence before AI interpretation.
Agent specialization
- Each step has a distinct role: scan, analyze, review, report.
Educational output
- The final report is designed to teach users why a vulnerability matters and how to fix it.
Real-world applicability
- Builders can use the workflow to understand smart contract risks before deploying or learning Web3 security.
Hackathon Update Note
AuditCraft was significantly updated during the Build with MeDo Hackathon.
The hackathon-period improvements include:
- Migrating the concept from a single security-analysis flow into a MeDo-powered multi-agent workflow.
- Adding the multi-turn conversation architecture.
- Adding plugin/tool integration planning for Etherscan-style retrieval and Slither-style static analysis.
- Improving the project narrative around smart contract security education.
- Reframing the app as an interactive learning sandbox rather than only an audit report generator.
These updates directly align with the Build with MeDo judging criteria:
- Innovation & Creativity: applying MeDo to smart contract security education.
- Implementation & Technical Depth: using multi-turn agent orchestration and tool-backed analysis.
- User Experience & Value: helping students and builders understand vulnerabilities through guided reports.
Built With
- docker
- fastapi
- nginx
- playwright
- postgresql
- py-solc-x
- pytest
- python
- redis
- vanilla-javascript
Log in or sign up for Devpost to join the conversation.