pujitha909/smart-contract-auditor

Smart Contract Auditor Environment

An OpenEnv benchmark where an agent audits Solidity contracts and reports vulnerabilities with type, location, severity, and fix suggestions.

Environment Summary

What This Environment Does

The environment provides Solidity contract code and accepts one finding per action. The agent can continue submitting findings or send done to finish the audit episode.

Action Space

Actions are represented by AuditAction.

Supported vulnerability labels:

reentrancy, integer_overflow, access_control, unchecked_return, tx_origin, selfdestruct, timestamp_dependence, front_running, delegatecall, denial_of_service, precision_loss, flash_loan, oracle_manipulation, uninitialized_storage, done

Observation Space

Observations are represented by AuditObservation.

Tasks

Easy - basic_audit

• —Single vulnerability in a short contract.

Medium - intermediate_audit

• —Two vulnerabilities with mixed patterns.

Hard - advanced_audit

• —Three vulnerabilities with subtle bugs and red herrings.

Reward Function

Per-finding scoring:

• —type match: +0.4
• —location match: +0.3
• —severity match: +0.1
• —quality fix suggestion: +0.2

Final episode score:

• —normalized by number of target vulnerabilities
• —false-positive penalty: 0.05 per unmatched finding
• —clipped to [0.0, 1.0]

Quick Start

1) Install dependencies

pip install -r requirements.txt

2) Run from source

python -m server.app

Open in browser:

http://127.0.0.1:7860

3) Run the baseline scripts

python inference.py
python inference_rl.py --task basic_audit --num-runs 5

Baseline Scores

Expected Inference Log Format

inference.py prints these line types:

[START] task=<task_name> env=smart_contract_auditor model=<model_name>
[STEP]  step=<n> action=<action_str> reward=<0.00> done=<true|false> error=<msg|null>
[END]   success=<true|false> steps=<n> score=<score> rewards=<r1,r2,...,rn>

Environment Variables

Example .env:

HF_TOKEN=hf_your_token_here
API_BASE_URL=https://router.huggingface.co/v1
MODEL_NAME=Qwen/Qwen2.5-72B-Instruct
LOCAL_IMAGE_NAME=smart-contract-auditor
# Optional
# GRADIO_SERVER_PORT=7860

Docker and Validation

openenv validate
docker build -t smart-contract-auditor .
docker run -d --name smart-contract-auditor-test -p 7860:7860 smart-contract-auditor
curl http://127.0.0.1:7860/health

Key Project Files

.
├── environment.py
├── models.py
├── contracts.py
├── inference.py
├── inference_rl.py
├── dashboard.py
├── server/
│   └── app.py
├── openenv.yaml
└── README.md

Troubleshooting

License

MIT