vaishnavi0905/solidityguard-env

SolidityGuard-Env 🛡️

 ![domain]() ![difficulty]()

The first OpenEnv environment for smart contract security auditing. An AI agent reads vulnerable Solidity contracts, identifies security flaws, classifies severity, and proposes patches — exactly what a human auditor does before a protocol goes live.

Why This Matters

Smart contract vulnerabilities have caused over $3 billion in losses — The DAO hack, Ronin Bridge, Euler Finance. Every contract needs a security audit before deployment. This environment trains and benchmarks AI agents to perform that audit automatically.

Environment Overview

The agent receives a Solidity contract and must:

1. 1.Detect vulnerabilities (reentrancy, access control, oracle manipulation, etc.)
2. 2.Classify severity: critical / high / medium / low
3. 3.Locate the vulnerable function
4. 4.Patch — suggest a concrete fix

Action Space

Observation Space

Tasks

Task 1 — Easy: SimpleBank (1 vulnerability)

• —Contract: A minimal ETH bank with deposit/withdraw
• —Vuln: Classic reentrancy in withdraw() — state updated after external call
• —Inspiration: The DAO hack, 2016 ($60M lost)

Task 2 — Medium: VaultManager (3 vulnerabilities)

• —Contract: Multi-user ETH vault with pause mechanism
• —Vulns: tx.origin authentication flaw, reentrancy in withdraw(), missing access control on emergencyDrain()
• —Challenge: Must find all three with correct severity classification

Task 3 — Hard: LendingPool (4 vulnerabilities)

• —Contract: DeFi lending pool with ERC-20 tokens, flash loans, collateral
• —Vulns: Flash loan reentrancy, integer precision loss, price oracle manipulation, admin rug pull
• —Challenge: Find all 4 AND suggest correct patches for each

Task 4 — Medium: NFTMint (3 vulnerabilities)

• —Contract: NFT minting contract with whitelist and 1000 max supply
• —Vulns: Weak randomness via block.timestamp, front-running in whitelist mint, locked ETH with no withdrawal
• —Challenge: Find all 3 including the subtle locked ETH issue

Task 5 — Hard: VulnToken ERC-20 (4 vulnerabilities)

• —Contract: ERC-20 token with EIP-2612 permit, about to list on DEX
• —Vulns: Approval race condition, cross-chain permit replay, unrestricted mint, fee-on-transfer inconsistency
• —Challenge: Find all 4 including the subtle cross-chain replay attack

Reward Function

score = detection(0.60) + patch(0.35) + finalize_bonus(0.05)
      - hint_penalty(0.10 each)
      - false_positive_penalty(0.05 each)

• —Detection: keyword + severity + location matching against ground truth
• —Patch: patch text matched against accepted fix patterns
• —Partial credit: incorrect severity = 0.5x detection score
• —Score range: 0.0 - 1.0

Setup

Local

pip install -r requirements.txt
uvicorn app:app --host 0.0.0.0 --port 7860

Docker

docker build -t solidityguard-env .
docker run -p 7860:7860 solidityguard-env

API Usage

curl -X POST "http://localhost:7860/reset?task_id=task1"

curl -X POST "http://localhost:7860/step?task_id=task1" \
  -H "Content-Type: application/json" \
  -d '{"action_type": "report_vulnerability", "params": {"name": "Reentrancy", "severity": "critical", "location": "withdraw", "description": "External call before state update"}}'

Running the Baseline

export API_BASE_URL="https://router.huggingface.co/v1"
export MODEL_NAME="meta-llama/Llama-3.3-70B-Instruct"
export HF_TOKEN="your_token_here"
export ENV_URL="http://localhost:7860"

python inference.py

Baseline Scores

Project Structure

solidityguard-env/
├── Dockerfile
├── openenv.yaml
├── inference.py
├── requirements.txt
├── README.md
├── app.py
└── env/
    ├── __init__.py
    ├── models.py
    ├── contracts.py
    ├── grader.py
    └── environment.py

Team

MindBloom — Built for OpenEnv Hackathon Round 1

Cybersecurity x Blockchain x AI agents