auditooor

Inspiration

I was inspired after seeing major bounty payouts shared publicly on X, which highlighted how fragmented and error- prone manual security review still is. I built Auditooor to move from ad-hoc investigation to a reproducible, agent-assisted, proof-first workflow that scales across audits.

What Auditooor Does

Auditooor is a deterministic security review pipeline with automated reasoning and strict verification gates. It is designed to discover high-confidence vulnerabilities and keep only evidence-backed findings.

It combines:

• Scope and deployment-intake preprocessing (SCOPE, SEVERITY, pinned repo, topology context).
• GitHub-backed intelligence collection: commits, PRs, issues, review threads, and source comments.
• Prior-audit reconciliation across prior findings to filter duplicates and out-of-scope overlap.
• Deployment-aware dataflow and code-surface preparation (including language-specific analyzers).
• Reasoning stage that turns findings into prioritized, testable hypotheses and proof obligations.
• Deep analysis lanes: static, symbolic, harness generation, fuzzing, and execution-based checks.
• Evidence assembly and final adjudication gates before anything is marked submission-ready.

The system uses canonical artifacts, machine-enforced sequencing, and reproducible receipts so an LLM output alone is never treated as proof.

Challenges We Overcame

A major bottleneck was feedback quality and speed. Without direct protocol for bounty-platform evidence, agents could overgenerate weak or repeated findings, including hallucinated claims.

The biggest fix was enforcing strict gates: every high-risk claim must be grounded in real evidence, tied to scope, and checked against prior findings and project history before advancing.

Accomplishments

• Built a multi-stage audit flow that is now substantially more deterministic and less manual.
• Added stronger proof discipline: reproducibility, cross-checks, and gating for submission-readiness.
• Integrated GitHub history and source-comment mining into the triage graph, instead of isolated report matching.
• Confirmed real submissions and remediation tracking in live teams over multiple workspaces.

What We Learned

• Effective model orchestration
• Each model has a role: source-mining, synthesis, dedupe/review, and proof validation.
• The fastest gains came from reducing ambiguity: strict schemas, bounded manifests, and mandatory evidence boundaries.
  • Human review still matters at final policy decisions, but the system reduces manual load and makes reviews materially more reliable.

What’s Next

Current focus is on:

• Deeper generic reasoning for all workspaces (language and bug-class portability),
• Expanded language/topic coverage (Rust, Go, Solidity, JS, and Move/Cairo direction),
• Will add formal verification methodology
• Continued reduction of false positives and duplicate handling,
• Better long-term learning from prior audit outcomes.

Built With

• echidna
• foundry
• github
• mcp
• python
• solidity