Developer Builds Offline RAG Tool to Search Five Years of Smart Contract Audit Reports

A blockchain security developer built a local retrieval-augmented generation (RAG) system to search through years of smart contract audit reports after struggling to locate a known vulnerability pattern in a folder of PDFs. The system uses Ollama for embeddings and SQLite for storage, running entirely offline with no API costs or rate limits. Rather than splitting documents into fixed-size chunks — a common RAG approach — the developer structured the system around individual audit findings as atomic units, preserving the integrity of each vulnerability's title, severity, description, and fix. A custom parser detects finding boundaries using regex patterns compatible with Code4rena, Sherlock, and Trail of Bits report formats. The project highlights how thousands of publicly available audit reports remain an underused resource in Web3 security, partly because the same bug class is often described using many different phrases.