Contract Guard: Autonomous Bug Bounty Hunter

The Immunefi bug bounty ecosystem pays out millions of dollars per year for smart contract vulnerabilities, yet the process of monitoring hundreds of in-scope contracts, classifying vulnerability patterns, and writing Foundry exploit proofs is entirely manual. A skilled auditor might review 3–5 protocols per week. I wanted to see if an autonomous system could do this continuously, around the clock.

The system is a TypeScript monorepo with a Next.js frontend and a background job engine powered by BullMQ. At its core, a scheduler periodically fetches active Immunefi programs, discovers their in-scope smart contract addresses across 19 EVM chains, and queues analysis jobs.

Each contract is decompiled and sent to a Claude AI pipeline that classifies it against 13+ known vulnerability categories (reentrancy, price manipulation, flash loan attacks, access control bypasses, and more). When a potential issue is found, the system auto-generates a Solidity proof-of-concept test using Foundry, forks the relevant mainnet, executes the exploit, and captures the result. Successful exploits trigger an instant Telegram notification with full context.

All state (scanned contracts, findings, and exploits) is persisted in Supabase. Playwright is used to interact with protocol frontends where on-chain analysis alone isn't sufficient.

I've been fascinated by the intersection of AI and blockchain security for years. After reading through dozens of post-mortems for major DeFi hacks, I noticed that most vulnerabilities follow repeatable patterns, the kind a well-prompted language model could potentially detect at scale.

This project was my attempt to productize that intuition. It's also a forcing function for me to go deeper into Solidity internals, EVM execution, and the Foundry testing ecosystem. Building the self-improving feedback loop (where past detections inform future scans) was the most intellectually rewarding part.

The current system handles static vulnerability pattern matching well. The next frontier is dynamic analysis: actually simulating complex multi-transaction attack sequences, modeling liquidity conditions, and reasoning about cross-protocol dependencies. I'm also exploring fine-tuning a smaller model on the existing detection corpus to reduce inference latency and cost per scan.