SentinelQwen

Inspiration

Smart contract vulnerabilities have caused over $3 billion in losses. The DAO hack ($60M), Poly Network ($611M), and Ronin Bridge ($625M) are just the tip of the iceberg. Manual security auditing is expensive ($10,000-$100,000 per audit), takes weeks, and requires scarce expert talent. We need an autonomous solution that can run 24/7, learn from every audit, and provide actionable fixes instantly.

What it does

SentinelQwen is an end-to-end autonomous agent that automates the entire smart contract security auditing workflow:

Code Intake — Submit Solidity via API, Web Dashboard, or Telegram Bot
Multi-Layer Analysis — Static analysis (Slither) + Pattern matching (14+ rules) + AI semantic analysis (Qwen 3.7 Plus)
Persistent Memory — ChromaDB vector store learns from past audits, auto-forgets outdated patterns after 90 days
Human-in-the-Loop — 3 critical checkpoints require human approval
Auto-Fix Generation — AI generates secure code fixes with gas impact analysis
Professional Reports — Markdown/HTML reports with risk scores and detailed findings

How we built it

Core: Python 3.11 with asyncio for concurrent processing
AI Engine: Qwen 3.7 Plus via DashScope API (991K context window)
Memory: ChromaDB vector database with sentence-transformers embeddings
API: Flask REST API with CORS
Bot: python-telegram-bot for mobile access
Cloud: Alibaba Cloud ECS + OSS + RDS + Redis
Deployment: Docker + Alibaba Cloud Function Compute

Challenges we ran into

Detection Layer Integration — Combining static, pattern, and AI analysis without duplicate findings
Token Optimization — Large contracts exceed context limits; implemented intelligent chunking
Memory Design — Balancing similarity search accuracy with retrieval speed
Human Checkpoint Design — Determining when approval is truly necessary vs. autonomous action

Accomplishments that we are proud of

14+ vulnerability types detected across 5 blockchains
Less than 5% false positive rate through multi-layer validation
Persistent learning memory that improves accuracy over time
Production-ready deployment on Alibaba Cloud with health checks
3 platforms from day one: API + Web + Telegram

What we learned

Qwen 3.7 Plus's 991K context window is transformative for code analysis
Vector databases enable truly intelligent agent memory, not just caching
Human-in-the-loop is a feature that builds trust in high-stakes security applications
Alibaba Cloud's integrated ecosystem significantly reduces deployment complexity