Contract Guard (archived)

Immunefi runs bug bounty programs that reward researchers for finding smart contract vulnerabilities, yet the process of monitoring hundreds of in-scope contracts, classifying vulnerability patterns, and writing Foundry exploit proofs is entirely manual. A skilled auditor might review 3–5 protocols per week. I wanted to see if an autonomous system could do this continuously, around the clock.

The system is a TypeScript monorepo with a Next.js frontend and a background job engine. At its core, a scheduler periodically fetches active Immunefi programs, discovers their in-scope smart contract addresses across 19 EVM chains, and queues analysis jobs.

Each contract is decompiled and sent to a Claude AI pipeline that classifies it against 13 known vulnerability categories (reentrancy, price manipulation, flash loan attacks, access control bypasses, and more). When a potential issue is found, the system auto-generates a Solidity proof-of-concept test using Foundry, forks the relevant mainnet, executes the exploit, and captures the result.

Playwright is used to interact with protocol frontends where on-chain analysis alone isn't sufficient.

I've been fascinated by the intersection of AI and blockchain security for years. After reading through dozens of post-mortems for major DeFi hacks, I noticed that most vulnerabilities follow repeatable patterns, the kind a well-prompted language model could potentially detect at scale.

This project was my attempt to productize that intuition. It's also a forcing function for me to go deeper into Solidity internals, EVM execution, and the Foundry testing ecosystem. Building the self-improving feedback loop (where past detections inform future scans) was the most intellectually rewarding part.