SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Multi-AI council found 4 bugs in smart contract that 5 individual models missed

0
·3 views

A developer auditing smart contracts for a Web3 banking project called SovereignBankWeb3 ran 13 manual review rounds using five AI models — Gemini, DeepSeek, ChatGPT, Grok, and Claude — yet all five individually declared the contracts secure. Despite extensive cross-validation done by hand, four critical vulnerabilities remained undetected, including a DoS vector, weak stablecoin validation, and reentrancy risks. The developer then tested a structured multi-agent system called Egregor, which coordinated all five models with defined roles and cross-validation algorithms designed to counter groupthink. In a single pass costing $0.40 via the OpenRouter API, the council identified all four previously missed vulnerabilities. The case study highlights the limitations of single-model AI audits and argues that structured multi-agent collaboration produces more reliable results for smart contract security.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer Red-Teams Own LLM Security Gateway, Documents Every Vulnerability Found

A software developer who built a security gateway for large language model traffic conducted four rounds of adversarial testing against their own tool to identify detection gaps. The gateway functions as a transparent proxy that scans requests and responses for leaked secrets, PII, jailbreaks, and prompt injection attempts using deterministic pattern matching in Rust. Testing revealed issues including Unicode tag character smuggling, overly broad keyword rules that blocked legitimate security questions, and narrow base64 detection patterns that attackers could easily sidestep. The developer fixed several vulnerabilities by improving input normalization and anchoring rules to intent rather than isolated keywords, while honestly documenting cases where regex-based detection alone cannot provide a solution. The project highlights a key tradeoff in security tooling: catching attacks without blocking legitimate traffic is as critical as detection itself.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Four Ways to Generate PDFs in Laravel: Comparing dompdf, Snappy, Browsershot, and APIs

Laravel developers generating PDFs typically choose between dompdf, laravel-snappy, Browsershot, or an HTML-to-PDF API, each carrying distinct trade-offs. Dompdf requires no binaries but is limited to CSS 2.1, forcing developers to maintain separate stylesheets for web and PDF output. Laravel-snappy relies on wkhtmltopdf, a binary based on an archived WebKit engine frozen around 2012 that lacks modern CSS support and no longer receives security updates. Browsershot uses headless Chrome for accurate rendering but requires Node, Puppeteer, and a Chrome binary on the server, adding operational complexity especially in serverless or shared hosting environments. A fourth approach sends rendered Blade HTML to an external API, returning a vector PDF generated by current Chrome without requiring any browser infrastructure on the server.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Shares Google Apps Script to Turn Gumroad Sales into AI-Powered Leads

A developer has published a roughly 70-line Google Apps Script that automatically converts every Gumroad product sale into a tracked, verified lead inside a Google Sheet. The system uses Gumroad's webhook ping to capture buyer details — including email, product name, and license key — without requiring a CRM or third-party tools like Zapier. Each incoming sale is deduplicated by sale ID and verified against Gumroad's license API to confirm the purchase is genuine before any follow-up is triggered. A time-based trigger then sends an AI-personalized upsell email to each new lead and marks the record to prevent duplicate outreach. The approach is framed as a higher-intent alternative to free lead magnets, since buyers have already demonstrated purchase intent with a small paid 'micro-commitment.'

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How React's useEffect Cleanup Functions Prevent Memory Leaks and Silent Bugs

React's useEffect hook is widely used for side effects like data fetching, timers, and event listeners, but omitting or incorrectly writing its cleanup function can cause memory leaks, duplicate handlers, and errors on unmounted components. The cleanup function, returned from useEffect, runs before the effect re-executes when dependencies change and again when the component unmounts. Common scenarios requiring cleanup include removing event listeners, clearing intervals, unsubscribing from sockets, and aborting fetch requests using AbortController. React's Strict Mode further exposes cleanup bugs by intentionally mounting, cleaning up, and remounting effects during development. Developers are advised to ensure every opened resource has a corresponding teardown path and that the dependency array is accurate to avoid stale closure issues.

0 comments Read more at DEV Community