Callisto Network

Recently, artificial intelligence has received serious development. In some areas, neural networks can already compete with humans. For example, <a href="https://www.midjourney.com/" rel="noopener noreferrer nofollow">Midjourney</a> can already produce high quality images and <a href="https://openai.com/blog/chatgpt" rel="noopener noreferrer nofollow">ChatGPT</a> can write or analyse fragments of code.Callisto Team is pioneering the adoption of neural networks in security area to automate the process of bulk code reviews.<h2 id="header-0">The task</h2>We decided to analyse real DeFi exploits in living DAPPs deployed on Ethereum chain. Since Monday, April 3 <a href="https://github.com/Dexaran" rel="noopener noreferrer nofollow">me</a> and <a href="https://github.com/yuriy77k" rel="noopener noreferrer nofollow">Yuriy</a> manually reviewed the codes of dozens of DeFis however with no significant results.The problem with finding an exploitable vulnerability in a DeFi right now is that there are too much DeFis and 90% of them are clones of one another and there can be no custom code. If you are reviewing the code that doesn’t contain any vulnerabilities — it doesn’t matter if you are a security expert or not, you will not find any vulnerabilities.<a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">The analysis of known DeFi hacks</a> showed that in most cases the exploitable vulnerability is a well-known mistake (such as replay attack or a code developer forgot to add “onlyOwner” modifier to governance functions).After that we came to the conclusion that in order to improve the security of the industry of smart-contracts we need a “security crawler” — a program that will continuously analyse the codes of newly created contracts and check them for well-known vulnerabilities. If the crawler would detect a vulnerability in a newly created contract — this can be fixed before this contract will receive significant amount of funds letting hackers to drain it later.<h2 id="header-1">AI powered security crawler</h2>The latest research showed that ChatGPT is capable of detecting vulnerabilities and exploits in a code. At least well-known vulnerabilities have a very high chance to be detected.The latest version of ChatGPT allows us to submit <a href="https://stealthoptional.com/how-to/chatgpt-too-many-requests-in-1-hour-try-again-later-fix/" rel="noopener noreferrer nofollow">20–30 requests per hour</a>.So, the plan is to create a program that will take the code of a <a href="https://etherscan.io/contractsVerified" rel="noopener noreferrer nofollow">verified contract from Etherscan</a> or similar explorer on another chain and then feed 20 of them per hour to ChatGPT. The contracts that will be flagged as “potentially insecure” will be manually reviewed by our security auditors.We are planning to scan all existing contracts on major chains to find any existing vulnerabilities. After that the crawler will stay online to monitor the newly created contracts.If this practice will prove efficient we can expand the functionality of the crawler to analyse the bytecodes of the contracts instead of just verified contracts.

AI-Powered Security Crawler for Smart Contracts: A Game Changer in Blockchain Security

Tabla de contenidos

Callisto Network

Otros artículos publicados el 14 abr 2023

Fusion swap resolving: onchain component

Hester Peirce Says SEC Might Kill US Innovation With Exchange Act Changes

ChainLink price analysis: LINK gains value and reaches $7.5

This Altcoin Exchange Was Hacked: Assets Stolen!

Polygon and Mastercard Unveil NFTs to Empower Emerging Musicians in Billion-$-Market

Friday Digest!

¡Únete a nuestro boletín gratuito para recibir actualizaciones diarias de criptografía!