Smart contracts are designed to execute financial and business logic automatically, but the same immutability that makes blockchain powerful also makes security mistakes extremely expensive. A vulnerability that reaches production can potentially lead to irreversible loss of assets.
I wanted to explore whether Generative AI could make smart contract security analysis more intelligent, explainable, and actionable.
That led me to build SmartContractGuardian (VLD) — an AI-powered Solidity security platform that combines static analysis, Retrieval-Augmented Generation (RAG), local Large Language Models (LLMs), multi-agent reasoning, exploit validation, and secure smart-contract generation.
The project is available on GitHub:
SmartContractGuardian: https://github.com/sayeedur007-design/SmartContractGuardian
Smart contract security is not a problem that can be solved reliably by simply asking an LLM:
"Find vulnerabilities in this Solidity contract."
A smart contract can contain subtle vulnerabilities involving:
Traditional static-analysis tools are extremely useful because they provide deterministic evidence, but their output can sometimes be difficult for developers to interpret or connect to the broader context of a contract.
On the other hand, LLMs are good at understanding source code and explaining complex logic, but they can hallucinate vulnerabilities or miss important security details.
I wanted to combine the strengths of both approaches.
The core idea is to create a pipeline where different techniques perform different jobs instead of expecting one AI model to do everything.
The system follows a workflow similar to:
Solidity Contract → Static Analysis → RAG Retrieval → Local AI Analysis → Independent Verification → Optional Exploit Validation → Secure Contract Generation → Final Validation
This separation is important.
Static analysis provides deterministic evidence.
RAG provides security-related context.
The LLM provides source-level reasoning and explanations.
A second agent challenges the initial findings.
Foundry can test whether generated exploit code actually executes.
Finally, the secure-contract generator produces a revised contract that must pass compilation and another security-analysis stage.
One of the design decisions I made was to keep the core AI workflow local.
Smart contracts can contain sensitive business logic, proprietary protocols, or unreleased code. Sending source code to an external AI service is not always desirable.
SmartContractGuardian therefore uses Ollama to run local models.
The current implementation uses:
This means the main AI analysis pipeline can operate without sending the analyzed Solidity source to a cloud LLM.
The repository currently uses the local model for several roles, including the Analyzer, Skeptic, Exploiter, Generator, Runner repair, and project-context workflows.
A major part of the project is Retrieval-Augmented Generation.
Instead of giving the LLM only the uploaded Solidity contract, SmartContractGuardian maintains a knowledge base containing known vulnerable Solidity examples and security information.
The system:
nomic-embed-text
.The important distinction is that retrieved contracts are treated as security context, not automatically as evidence that the uploaded contract contains the same vulnerability.
This reduces one of the common problems with naive RAG systems: assuming that similarity automatically means correctness.
Another important part of SmartContractGuardian is the use of multiple specialized AI roles.
Instead of relying on a single LLM response, the system separates responsibilities.
The Analyzer examines:
It produces structured vulnerability findings.
The Skeptic acts as an independent reviewer.
Its job is not simply to agree with the Analyzer.
It goes back to the original source and asks whether the proposed vulnerability is actually supported by the available evidence.
This creates a useful pattern:
Agent A proposes → Agent B challenges → System recalibrates confidence
That is much closer to a security-review workflow than simply generating an answer from one prompt.
For eligible findings, the Exploiter can produce structured exploit plans.
However, the system deliberately separates an exploit hypothesis from a validated exploit.
A generated exploit plan is not treated as successful merely because an LLM produced it.
This was one of the areas where I wanted to avoid overclaiming what an LLM can do.
SmartContractGuardian can integrate with Foundry to compile and execute generated Proof-of-Concept exploits.
The workflow can:
PASSED
, FAILED
, TIMEOUT
, or ERROR
.This distinction matters.
A language model saying:
"This vulnerability can be exploited"
is not the same as an exploit actually executing successfully.
SmartContractGuardian therefore keeps generated plans, generated code, and validated execution results as separate pieces of evidence.
The project does not stop after detecting vulnerabilities.
I also wanted to explore the opposite direction:
Can the system generate a safer version of the contract?
The Secure Contract Generator receives the original Solidity source together with validated vulnerability findings.
It then generates a revised contract.
But the generated code is not immediately presented as "secure."
Instead, it goes through additional validation:
Original Contract → Security Analysis → Vulnerability Verification → Secure Generation → Deterministic Checks → Compilation → Final Slither Analysis
If the generated contract fails certain checks, the system can perform a targeted repair-generation pass and validate the result again.
The final downloadable contract is exposed only after compilation and final static validation pass.
This creates an important principle for AI-generated security code:
Generation should be followed by verification.
Google's developer tooling played an important role in building SmartContractGuardian.
I used Google Antigravity IDE as an agentic development environment while working across the frontend, backend, AI workflows, debugging, and project architecture.
What made it particularly useful for this project was that the development workflow was not limited to simple code completion.
Antigravity's agents can work across the editor, terminal, and browser, which is particularly useful for a project containing many interconnected components.
SmartContractGuardian contains multiple layers:
Working on these components requires repeatedly moving between code, terminal output, generated files, tests, and the running application.
Antigravity helped me iterate across these surfaces instead of treating each coding task as an isolated file-editing problem.
I also explored the Google Antigravity SDK as part of the project development process.
The Antigravity SDK provides programmatic access to the Antigravity agent runtime, making it possible to build custom agentic workflows rather than interacting with an AI coding agent only through an IDE interface. Google describes the SDK as a Python library for prototyping and building applications on top of the Antigravity Agent Runtime.
This was particularly relevant to my project because SmartContractGuardian itself is fundamentally an agentic system.
The project contains specialized roles such as:
Analyzer → Skeptic → Exploiter → Generator → Runner
Exploring an agent-oriented development environment alongside an agent-oriented application gave me a better understanding of how AI agents can be used not only as chatbots, but as components of larger software workflows.
Although the current SmartContractGuardian security-analysis pipeline is intentionally local, Google's broader AI ecosystem provides interesting possibilities for future versions.
For example, the Google GenAI SDK provides official libraries for integrating Gemini models into applications using Python, JavaScript/TypeScript, Go, and Java.
A future version of SmartContractGuardian could optionally use Gemini for tasks such as:
This would be an optional extension, rather than replacing the local-security architecture.
That distinction is important because privacy and local execution are core design goals of the current project.
At a high level, the architecture looks like this:
Solidity Contract
│
▼
┌───────────────────┐
│ Static Analysis │
│ Slither │
└─────────┬─────────┘
│
▼
┌───────────────────┐
│ Contract Context │
│ Functions / Calls │
│ Security Signals │
└─────────┬─────────┘
│
▼
┌───────────────────┐
│ RAG Retrieval │
│ ChromaDB + Local │
│ Embeddings │
└─────────┬─────────┘
│
▼
┌───────────────────┐
│ Local Analyzer │
│ Qwen2.5-Coder │
└─────────┬─────────┘
│
▼
┌───────────────────┐
│ Skeptic Agent │
│ Independent Check │
└─────────┬─────────┘
│
┌─────────┴─────────┐
▼ ▼
Exploit Analysis Secure Generation
│ │
▼ ▼
Foundry Compile + Validation
│ │
└─────────┬─────────┘
▼
Final Results
Building SmartContractGuardian taught me that integrating Generative AI into a security application is not simply a matter of connecting an LLM to a prompt.
The difficult part is designing the surrounding system.
I learned several important lessons.
An LLM can generate convincing explanations while still being wrong.
Security systems need independent evidence and validation.
Adding a vector database does not automatically make an AI system reliable.
The retrieved context has to be relevant, correctly chunked, and properly interpreted.
Separating analysis, skepticism, exploitation, generation, and validation makes the workflow easier to reason about and debug.
Compilation, static analysis, and execution provide evidence that a language model cannot provide by itself.
Using an agentic IDE such as Google Antigravity changed my development workflow from simply writing individual functions to delegating larger engineering tasks, reviewing generated changes, testing them, and iterating.
The project was far from straightforward.
Some of the biggest challenges included:
These challenges reinforced an important idea:
The engineering around an AI model is often as important as the model itself.
SmartContractGuardian is a research and development project, not a replacement for a professional smart-contract security audit.
Passing static analysis or an AI review does not prove that a contract is completely secure.
There can always be vulnerabilities that the current rules, datasets, models, or validation procedures fail to detect.
Similarly, a successful generated PoC demonstrates a particular exploit path but does not represent every possible attack.
The goal of the project is therefore not to claim:
"AI can guarantee secure smart contracts."
The goal is:
Use AI, retrieval, static analysis, and execution-based validation together to make smart-contract security analysis more powerful and actionable.
There are several directions I want to explore next.
Keep sensitive contract analysis local while optionally using Gemini for higher-level explanations or interactive assistance.
Expand the vulnerability dataset and evaluate detection performance systematically across different vulnerability categories.
Measure how often the Skeptic agent correctly rejects false positives and how much multi-agent verification improves precision.
Every improvement to the Analyzer or Generator should be evaluated against a fixed vulnerability benchmark to detect regressions.
The generator could move toward an iterative:
Generate → Analyze → Repair → Compile → Analyze Again
loop until the generated contract satisfies a defined validation policy.
Future versions could transform raw findings into clearer remediation reports explaining:
SmartContractGuardian started with a simple question:
Can Generative AI help developers find and fix smart-contract vulnerabilities?
The project evolved into something broader.
It combines:
Static Analysis + RAG + Local LLMs + Multi-Agent Reasoning + Exploit Validation + Secure Code Generation
The biggest lesson from building it is that reliable AI applications need more than a powerful model.
They need evidence.
They need retrieval.
They need validation.
And they need carefully designed workflows around the model.
Using Google Antigravity and its agentic development capabilities also gave me an opportunity to experience how AI can participate directly in the software-engineering process, from implementation and debugging to iteration and verification.
SmartContractGuardian is my attempt to apply these ideas to one of the areas where reliability matters most: blockchain security.
GitHub:
https://github.com/sayeedur007-design/SmartContractGuardian
Project: SmartContractGuardian (VLD)
Focus: AI-powered Solidity vulnerability detection, validation, and secure-contract generation
Core technologies: Solidity, Python, Flask, React, Slither, Ollama, Qwen2.5-Coder, ChromaDB, RAG, LangChain, Foundry, Socket.IO, Google Antigravity IDE, and Antigravity SDK.
The project intentionally keeps its core security-analysis LLM workflow local while leaving room for optional integration with Google's generative AI ecosystem.