• 

  attest

About the project

Attest began with a simple observation: smart-contract developers have access to powerful security tools, but using them effectively still requires substantial security expertise.

Running Slither or Foundry is relatively easy. Knowing which properties matter for a particular contract, which warnings are meaningful, which tests should be written, and whether the combined evidence supports a clear conclusion is much harder.

We built Attest to explore a more useful model: an AI-led Solidity auditing workbench where the AI acts like an auditor not merely a chatbot or report formatter. It reads the complete contract, traces its logic and trust assumptions, decides what needs verification, directs the available tools, cross-checks their evidence, and explains the result in practical language.

Attest was created entirely during the hackathon through human directed vibe coding with Codex. It demonstrates how AI can help turn an ambitious product idea into a working full stack developer tool within a very limited timeframe.

What it does

Attest provides three straightforward audit depths:

1. AI Review — Reads and traces the complete Solidity contract, identifies meaningful security and logic concerns, and provides a source-grounded assessment.
2. Targeted Verification — Uses the AI review to decide which specific claims need stronger evidence, then designs and runs pertinent tests rather than applying the same generic checklist to every contract.
3. Full Audit Suite — Performs broader analysis and testing for users who want more extensive coverage, including lower-severity and code-quality observations.

The current MVP can:

• Accept Solidity source files through a local browser interface.
• Classify contract behavior, assets, roles, trust boundaries, and external dependencies.
• Distinguish expected behavior from actual security concerns.
• Run and normalize evidence from Slither, Aderyn, Solhint, Foundry, and local Anvil environments.
• Compile contracts using compatible Solidity versions.
• Generate contract-specific Foundry tests.
• Deploy eligible contracts to disposable local chains.
• Support targeted fork-based verification when a contract depends on existing chain state.
• Cross-check analyzer warnings against the complete source instead of presenting every detector result as a vulnerability.
• Keep the user informed through a single audit dialogue and live progress display.
• Accept follow-up information or instructions through the Audit Copilot.
• Produce concise Markdown and JSON audit artifacts after analysis and testing conclude.
• Preserve a readable worklog showing what was examined, what ran, and how the final assessment was reached.

Attest does not modify or repair submitted contracts. Source remains read-only during an audit. The product focuses on tracing, testing, evidence, and conclusions while leaving code changes under the developer’s control.

How we built it

Attest runs locally as a browser-based application backed by a Node.js audit service. Users can sign in with their ChatGPT account through the local Codex integration, avoiding the need to paste an API key into the application.

The audit pipeline combines two complementary systems:

• AI judgment determines what the contract does, which risks are relevant, what evidence is missing, and whether more testing is justified.
• Deterministic tools provide reproducible evidence through compilation, static analysis, deployment, transaction execution, assertions, and chain-state inspection.

The AI leads the process. It first develops a whole contract understanding, then uses tools to confirm or challenge its conclusions. Tool output is treated as evidence not automatically promoted into a finding.

Each audit follows a practical progression:

Source intake
    ↓
Whole-contract AI review
    ↓
Risk and behavior prioritization
    ↓
Tool-directed verification
    ↓
Evidence cross-checking
    ↓
Plain-language conclusion
    ↓
Markdown and JSON reports

We audited our own dependencies throughout development rather than postponing dependency review until the end. The repository includes automated checks, dependency monitoring, repeatable installation, and documented validation procedures.

Challenges we ran into

The hardest challenge was not connecting individual tools. It was designing a coherent audit controller.

Static analyzers can produce dozens of technically valid observations that are irrelevant in context. Presenting all of them as issues creates fear rather than clarity. Attest needed to understand concepts such as trusted ownership, constructor-only behavior, intentional token mechanics, and contract-specific economic assumptions before judging detector output.

Test generation introduced another challenge. Early approaches relied too heavily on predetermined test harnesses and generic verification questions. That produced lengthy lists of unverified properties instead of a useful audit. We redesigned the workflow so the AI first traces the contract, reaches the conclusions it can establish from source, and only orders tests where execution evidence would materially improve confidence.

Local deployment also required careful handling of constructor arguments, compiler availability, linked contracts, external dependencies, payable values, and fork configuration. A failed or unavailable check must not stall the entire audit. Attest records the limitation, preserves completed evidence, and continues toward an honest conclusion.

Finally, communicating progress was surprisingly important. AI analysis can take time, and a technically active process can look frozen. We consolidated overlapping logs into one dialogue, added a persistent live status area, and made detailed evidence available without overwhelming the main assessment.

Accomplishments that we're proud of

We are proud that Attest progressed beyond an “upload a contract and ask GPT for an opinion” demonstration.

The MVP combines AI reasoning with real developer tooling, isolated compilation, generated tests, disposable chain environments, normalized evidence, and report generation. More importantly, it is built around the idea that different contracts require different audits.

We are also proud of the interaction model. A user chooses one of three audit depths, submits a contract, and receives a practical assessment without needing to understand every analyzer, compiler flag, or testing framework involved.

The project was strictly vibe coded during the hackathon. Product direction, security assumptions, workflow problems, regressions, and interface decisions were discussed in natural language, while Codex helped translate that direction into architecture, implementation, tests, documentation, and a working application.

Attest is an MVP rather than a finished commercial auditor, but it validates the difficult and valuable part of the concept: AI can serve as the coordinating intelligence between source code, security tools, test environments, evidence, and the developer.

What we learned

We learned that more tool output does not automatically create a better audit. Useful security analysis depends on context, prioritization, and the ability to explain what the evidence actually proves.

We also learned that AI is most effective when it is given responsibility for judgment while deterministic tools remain responsible for reproducible execution. Neither side is sufficient alone:

• AI without tools can produce plausible but unverified conclusions.
• Tools without contextual reasoning can produce noisy, misleading reports.
• Combining both allows the AI to form a hypothesis, select appropriate verification, inspect the results, and revise its conclusion.

Another major lesson was that “inconclusive” should not be a default endpoint. A helpful auditor must distinguish between a real blocker, an optional confidence improvement, an unavailable environmental check, and a question that can already be answered by tracing the source.

Most importantly, we learned how far a small team can go with human judgment, a clear product goal, and AI-assisted development. Vibe coding did not eliminate the need for decisions—it dramatically shortened the distance between those decisions and a working product.

What's next for Attest

The next phase is to turn the validated MVP into a polished and extensible auditing platform.

Planned work includes:

• Complete execution adapters for Echidna, Halmos, Mythril, and Solidity SMTChecker.
• Deeper invariant, fuzz, symbolic-execution, and stateful testing campaigns.
• First-class Ethereum, Base, and BNB Chain fork workflows.
• Multi-file projects, imported packages, proxies, and linked-library support.
• Stronger compiler-version and deployed-bytecode comparison.
• Historical audit comparison and regression testing.
• Repository and pull-request integrations.
• Team workspaces and shareable audit sessions.
• Desktop application packaging.
• A hardened backend for hosted deployment.
• Signed, reproducible evidence bundles for professional review.
• Expanded dependency and supply-chain security checks.
• Human-auditor handoff for high-value or high-risk contracts.

The long term goal is not to replace experienced security professionals. It is to make disciplined, contract-specific security thinking accessible much earlier in development and to give both new and experienced developers an intelligent auditor that knows when to read, when to test, when to challenge a warning, and when to raise a genuine concern.

Built With

• aderyn
• anvil
• artificial
• blockchain
• codex
• contracts
• css3
• foundry
• fuzz
• github
• html5
• intelligence
• javascript
• local-first
• node.js
• openai
• security
• slither
• smart
• solhint
• solidity
• testing
• vibe