DOLOS Tool Lets Developers Attack Live Smart Contracts Safely via Disposable Forks

·19 views

A development team has released DOLOS, an open-source dynamic EVM attack harness designed to red-team deployed smart contracts without touching live blockchain state. The tool spins up a throwaway Anvil fork — a copy-on-write clone of the live chain — so exploits can be tested against real contract state, balances, and storage without any risk to production systems. DOLOS was built to fill a gap between the team's existing static auditor (BASANOS) and their HTTP federation probe (MOMUS), enabling concrete attack simulations rather than theoretical code analysis. Each scan produces one of three outcomes: 'held' if the contract resisted, 'exploited' if an invariant broke, or 'inconclusive' if the test could not run — with inconclusive explicitly never treated as a pass. The project is live at dolos.modelmarket.dev and published under the MIT licence on GitHub.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI agents can use your browser session instead of your password, experts say

APX, a free open-source desktop app, lets users run their own AI agents locally, including for tasks on websites. The article argues that the key question is who signs in, which browser session is used, and what the agent may do afterward, rather than whether the agent can open a browser. Users are advised to start with narrow tasks, verify the site address before entering credentials, and complete one-time codes or CAPTCHAs themselves. APX offers a browser handoff feature so a person can take over the tab for sensitive steps, though this requires a desktop browser rather than a headless one. The piece also cautions that a successful login does not confirm the task was completed, and recommends signing out and reviewing permissions once access is no longer needed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Auditing AI C++ Patch Graders by Seeding Faulty Mutants

A hypothetical example describes an eval harness that reported PASS on AI-generated C++ patches for weeks while a signed modulo replacing a bounded comparison went undetected. The unit tests and sanitizer checks stayed green because no test case exercised the faulty branch, showing that a passing report does not prove the grader can still catch a given failure. The proposed remedy is a weekly self-audit that pushes known-faulty patches, called mutants, through the real harness and flags any grader that fails to reject them. Each mutant is declared in a manifest with the graders that must catch it, and a surviving mutant counts as a finding. The approach requires a clean git worktree and a harness that reports per-grader status in machine-readable form.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Declaring Degradation: A Fallback Contract for AI Agents That Lose Their Cloud Model

An illustrative scenario describes a nightly job that tags support tickets via a remote model, where a retry wrapper silently returns empty tags during timeouts and the failure goes unnoticed. The author argues this is a missing contract between a capability and its degraded form, not a model-quality issue. The proposed remedy is a three-tier declaration (local_only, cloud_preferred, cloud_required) that specifies whether each tool may leave the host and what it may return when the cloud path is unavailable. Declarations live alongside each tool as data, so reviewers can audit them and missing entries fail at startup rather than at runtime. A small outcome object reporting status (ok, degraded, refused) and payload source is recommended over resolvers that return inconsistent values.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AetherScope V2.2.1 releases a Rust-based SAST tool with 3D code visualization and an MCP server for AI agents

AetherScope V2, a native Rust engine called aether-engine, merges four tools into a single fast binary aimed at checking code written by AI agents such as Claude, Cursor and Antigravity. It offers a WebGL 2 interactive 'galaxy' view of codebases or Obsidian vaults, plus a real-time static analysis linter that runs in under 50 ms on each save. The linter covers over 185 CWE and zero-day rules across several languages, along with taint tracking, SCA via OSV.dev and SARIF 2.1.0 export. A spec-driven governance feature seals per-folder rules with BLAKE3 hashes and blocks unsigned AI changes, while an MCP server lets agents verify patches in real time. The project is demonstrated through a live web demo and a GitHub release for version 2.2.1.

0 comments Read more at DEV Community