Audit Solidity Smart Contracts with AI in 20 Minutes

# Install dependencies
npm install --save-dev @openzeppelin/contracts
forge install foundry-rs/forge-std

# Compile to catch syntax issues first
forge build

# Save as audit-prompt.md

Analyze this Solidity contract for vulnerabilities. Focus on:

1. **Reentrancy:** External calls that allow recursive re-entry
2. **Access Control:** Functions missing proper authorization
3. **Integer Issues:** Overflow/underflow (if Solidity <0.8.0)
4. **Front-Running:** Transaction ordering dependencies
5. **Gas Optimization:** Unnecessary SLOAD operations

For each issue:
- Severity: Critical | High | Medium | Low
- Line numbers
- Exploit scenario
- Recommended fix

Contract:

# Using Claude API (example with Python)
cat > audit.py << 'EOF'
import anthropic
import os

client = anthropic.Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

# Read your contract
with open("src/MyContract.sol", "r") as f:
    contract_code = f.read()

with open("audit-prompt.md", "r") as f:
    prompt = f.read()

message = client.messages.create(
    model="claude-sonnet-4-20250514",  # Best for code analysis
    max_tokens=4000,
    messages=[
        {"role": "user", "content": f"{prompt}\n\n```solidity\n{contract_code}\n```"}
    ]
)

# Save audit report
with open("audit-report.md", "w") as f:
    f.write(message.content[0].text)

print("✓ Audit complete. Check audit-report.md")
EOF

python audit.py

# Install Slither (Trail of Bits tool)
pip install slither-analyzer --break-system-packages

# Run automated checks
slither . --exclude-dependencies

# Compare with AI findings
diff <(grep -o "Line [0-9]*" audit-report.md | sort) \
     <(slither . --json - | jq '.results[].check' | sort)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract VulnerableBank {
    mapping(address => uint256) public balances;
    
    function deposit() public payable {
        balances[msg.sender] += msg.value;
    }
    
    // ❌ CRITICAL: Reentrancy vulnerability
    function withdraw(uint256 amount) public {
        require(balances[msg.sender] >= amount, "Insufficient balance");
        
        // External call BEFORE state update
        (bool success, ) = msg.sender.call{value: amount}("");
        require(success, "Transfer failed");
        
        balances[msg.sender] -= amount;  // Too late!
    }
}

**CRITICAL: Reentrancy in withdraw() - Line 15**

Severity: Critical
Impact: Complete fund drainage

Exploit:
1. Attacker calls withdraw()
2. Fallback function re-enters withdraw()
3. Balance check passes (not updated yet)
4. Process repeats until contract drained

Fix:
- Move balance update before external call (Checks-Effects-Interactions pattern)
- Or use ReentrancyGuard from OpenZeppelin

function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount, "Insufficient balance");
    
    // Update state FIRST
    balances[msg.sender] -= amount;
    
    // Then make external call
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success, "Transfer failed");
}

// test/VulnerableBank.t.sol
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import "../src/VulnerableBank.sol";

contract Attacker {
    VulnerableBank public bank;
    uint256 public attackCount;
    
    constructor(address _bank) {
        bank = VulnerableBank(_bank);
    }
    
    receive() external payable {
        // Try to re-enter (should fail with fixed version)
        if (attackCount < 3) {
            attackCount++;
            bank.withdraw(1 ether);
        }
    }
    
    function attack() public payable {
        bank.deposit{value: msg.value}();
        bank.withdraw(1 ether);
    }
}

contract VulnerableBankTest is Test {
    VulnerableBank public bank;
    
    function testReentrancyPrevented() public {
        bank = new VulnerableBank();
        Attacker attacker = new Attacker(address(bank));
        
        // Fund bank
        vm.deal(address(bank), 10 ether);
        
        // Attacker deposits 1 ETH
        vm.deal(address(attacker), 1 ether);
        attacker.attack{value: 1 ether}();
        
        // With fix: attacker should only withdraw once
        assertEq(address(bank).balance, 10 ether);  // Bank funds safe
    }
}

# Run test
forge test --match-test testReentrancyPrevented -vvv

# Should pass with fixed version

# 1. AI analysis
python audit.py

# 2. Static analysis
slither . --exclude-dependencies

# 3. Automated tests
forge test

# 4. Generate coverage report
forge coverage --report summary

# Complete production audit script
cat > full-audit.sh << 'EOF'
#!/bin/bash
set -e

echo "🔍 Starting comprehensive audit..."

# 1. Compile and check dependencies
echo "Step 1: Compilation"
forge build

# 2. AI analysis
echo "Step 2: AI audit (Claude)"
python audit.py

# 3. Static analysis
echo "Step 3: Slither"
slither . --exclude-dependencies --json slither-report.json

# 4. Test coverage
echo "Step 4: Test coverage"
forge coverage --report lcov

# 5. Gas optimization check
echo "Step 5: Gas report"
forge test --gas-report

# 6. Generate summary
cat > AUDIT_SUMMARY.md << 'SUMMARY'
# Audit Results - $(date)

## Critical Issues
$(grep -A 5 "CRITICAL" audit-report.md || echo "None found")

## High Severity
$(grep -A 5 "HIGH" audit-report.md || echo "None found")

## Coverage
$(forge coverage --report summary)

## Next Steps
- [ ] Fix critical issues
- [ ] Re-run tests
- [ ] Schedule professional audit
SUMMARY

echo "✅ Audit complete. Check AUDIT_SUMMARY.md"
EOF

chmod +x full-audit.sh
./full-audit.sh

// AI detects: external call before state update
(bool success,) = recipient.call{value: amount}("");
balance -= amount; // ❌ Too late

// AI detects: ignored return value
token.transfer(recipient, amount); // ❌ Should check success

// AI detects: missing modifier
function withdraw() public { // ❌ Anyone can call
    // Should be onlyOwner
}

// AI detects: unchecked arithmetic
uint256 total = balance + amount; // ❌ Can overflow

// AI detects: MEV vulnerability
function buyTokens() public payable {
    uint256 price = getCurrentPrice(); // ❌ Sandwich attack risk
    // Price can change before tx mines
}

# ❌ Vague prompt
"Check this contract for security issues"

# ✅ Specific prompt
"Analyze for reentrancy in functions with external calls. 
For each finding, provide:
1. Attack scenario with example addresses
2. Profit calculation for attacker
3. Solidity 0.8+ compatible fix"

// AI may flag this as reentrancy
function safeWithdraw() public nonReentrant {
    // OpenZeppelin guard makes this safe
    (bool success,) = msg.sender.call{value: balance}("");
}

// Tell AI in comments:
// @audit This is safe - nonReentrant modifier prevents reentrancy

# Tell AI your Solidity version
"This contract uses Solidity 0.8.20. 
Ignore overflow checks (built-in since 0.8.0).
Focus on reentrancy and access control."