{"slug": "building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security", "title": "Building SmartContractGuardian: An Agentic AI Approach to Smart Contract Security", "summary": "A developer has built SmartContractGuardian (VLD), an AI-powered Solidity security platform that combines static analysis, retrieval-augmented generation, local large language models, multi-agent reasoning, exploit validation, and secure smart-contract generation. The system uses Ollama to run local models, ensuring sensitive smart contract code is not sent to external AI services. It employs multiple specialized AI roles, including an Analyzer and a Skeptic, to improve the accuracy and explainability of vulnerability detection.", "body_md": "Smart contracts are designed to execute financial and business logic automatically, but the same immutability that makes blockchain powerful also makes security mistakes extremely expensive. A vulnerability that reaches production can potentially lead to irreversible loss of assets.\n\nI wanted to explore whether Generative AI could make smart contract security analysis more intelligent, explainable, and actionable.\n\nThat led me to build **SmartContractGuardian (VLD)** — an AI-powered Solidity security platform that combines static analysis, Retrieval-Augmented Generation (RAG), local Large Language Models (LLMs), multi-agent reasoning, exploit validation, and secure smart-contract generation.\n\nThe project is available on GitHub:\n\n**SmartContractGuardian:** [https://github.com/sayeedur007-design/SmartContractGuardian](https://github.com/sayeedur007-design/SmartContractGuardian)\n\nSmart contract security is not a problem that can be solved reliably by simply asking an LLM:\n\n\"Find vulnerabilities in this Solidity contract.\"\n\nA smart contract can contain subtle vulnerabilities involving:\n\nTraditional static-analysis tools are extremely useful because they provide deterministic evidence, but their output can sometimes be difficult for developers to interpret or connect to the broader context of a contract.\n\nOn the other hand, LLMs are good at understanding source code and explaining complex logic, but they can hallucinate vulnerabilities or miss important security details.\n\nI wanted to combine the strengths of both approaches.\n\nThe core idea is to create a pipeline where different techniques perform different jobs instead of expecting one AI model to do everything.\n\nThe system follows a workflow similar to:\n\n**Solidity Contract → Static Analysis → RAG Retrieval → Local AI Analysis → Independent Verification → Optional Exploit Validation → Secure Contract Generation → Final Validation**\n\nThis separation is important.\n\nStatic analysis provides deterministic evidence.\n\nRAG provides security-related context.\n\nThe LLM provides source-level reasoning and explanations.\n\nA second agent challenges the initial findings.\n\nFoundry can test whether generated exploit code actually executes.\n\nFinally, the secure-contract generator produces a revised contract that must pass compilation and another security-analysis stage.\n\nOne of the design decisions I made was to keep the core AI workflow local.\n\nSmart contracts can contain sensitive business logic, proprietary protocols, or unreleased code. Sending source code to an external AI service is not always desirable.\n\nSmartContractGuardian therefore uses **Ollama** to run local models.\n\nThe current implementation uses:\n\nThis means the main AI analysis pipeline can operate without sending the analyzed Solidity source to a cloud LLM.\n\nThe repository currently uses the local model for several roles, including the Analyzer, Skeptic, Exploiter, Generator, Runner repair, and project-context workflows.\n\nA major part of the project is Retrieval-Augmented Generation.\n\nInstead of giving the LLM only the uploaded Solidity contract, SmartContractGuardian maintains a knowledge base containing known vulnerable Solidity examples and security information.\n\nThe system:\n\n`nomic-embed-text`\n\n.The important distinction is that retrieved contracts are treated as **security context**, not automatically as evidence that the uploaded contract contains the same vulnerability.\n\nThis reduces one of the common problems with naive RAG systems: assuming that similarity automatically means correctness.\n\nAnother important part of SmartContractGuardian is the use of multiple specialized AI roles.\n\nInstead of relying on a single LLM response, the system separates responsibilities.\n\nThe Analyzer examines:\n\nIt produces structured vulnerability findings.\n\nThe Skeptic acts as an independent reviewer.\n\nIts job is not simply to agree with the Analyzer.\n\nIt goes back to the original source and asks whether the proposed vulnerability is actually supported by the available evidence.\n\nThis creates a useful pattern:\n\n**Agent A proposes → Agent B challenges → System recalibrates confidence**\n\nThat is much closer to a security-review workflow than simply generating an answer from one prompt.\n\nFor eligible findings, the Exploiter can produce structured exploit plans.\n\nHowever, the system deliberately separates an **exploit hypothesis** from a **validated exploit**.\n\nA generated exploit plan is not treated as successful merely because an LLM produced it.\n\nThis was one of the areas where I wanted to avoid overclaiming what an LLM can do.\n\nSmartContractGuardian can integrate with **Foundry** to compile and execute generated Proof-of-Concept exploits.\n\nThe workflow can:\n\n`PASSED`\n\n, `FAILED`\n\n, `TIMEOUT`\n\n, or `ERROR`\n\n.This distinction matters.\n\nA language model saying:\n\n\"This vulnerability can be exploited\"\n\nis not the same as an exploit actually executing successfully.\n\nSmartContractGuardian therefore keeps generated plans, generated code, and validated execution results as separate pieces of evidence.\n\nThe project does not stop after detecting vulnerabilities.\n\nI also wanted to explore the opposite direction:\n\n**Can the system generate a safer version of the contract?**\n\nThe Secure Contract Generator receives the original Solidity source together with validated vulnerability findings.\n\nIt then generates a revised contract.\n\nBut the generated code is not immediately presented as \"secure.\"\n\nInstead, it goes through additional validation:\n\n**Original Contract → Security Analysis → Vulnerability Verification → Secure Generation → Deterministic Checks → Compilation → Final Slither Analysis**\n\nIf the generated contract fails certain checks, the system can perform a targeted repair-generation pass and validate the result again.\n\nThe final downloadable contract is exposed only after compilation and final static validation pass.\n\nThis creates an important principle for AI-generated security code:\n\nGeneration should be followed by verification.\n\nGoogle's developer tooling played an important role in building SmartContractGuardian.\n\nI used **Google Antigravity IDE** as an agentic development environment while working across the frontend, backend, AI workflows, debugging, and project architecture.\n\nWhat made it particularly useful for this project was that the development workflow was not limited to simple code completion.\n\nAntigravity's agents can work across the editor, terminal, and browser, which is particularly useful for a project containing many interconnected components.\n\nSmartContractGuardian contains multiple layers:\n\nWorking on these components requires repeatedly moving between code, terminal output, generated files, tests, and the running application.\n\nAntigravity helped me iterate across these surfaces instead of treating each coding task as an isolated file-editing problem.\n\nI also explored the **Google Antigravity SDK** as part of the project development process.\n\nThe Antigravity SDK provides programmatic access to the Antigravity agent runtime, making it possible to build custom agentic workflows rather than interacting with an AI coding agent only through an IDE interface. Google describes the SDK as a Python library for prototyping and building applications on top of the Antigravity Agent Runtime.\n\nThis was particularly relevant to my project because SmartContractGuardian itself is fundamentally an agentic system.\n\nThe project contains specialized roles such as:\n\n**Analyzer → Skeptic → Exploiter → Generator → Runner**\n\nExploring an agent-oriented development environment alongside an agent-oriented application gave me a better understanding of how AI agents can be used not only as chatbots, but as components of larger software workflows.\n\nAlthough the current SmartContractGuardian security-analysis pipeline is intentionally local, Google's broader AI ecosystem provides interesting possibilities for future versions.\n\nFor example, the **Google GenAI SDK** provides official libraries for integrating Gemini models into applications using Python, JavaScript/TypeScript, Go, and Java.\n\nA future version of SmartContractGuardian could optionally use Gemini for tasks such as:\n\nThis would be an **optional extension**, rather than replacing the local-security architecture.\n\nThat distinction is important because privacy and local execution are core design goals of the current project.\n\nAt a high level, the architecture looks like this:\n\n```\n                    Solidity Contract\n                           │\n                           ▼\n                 ┌───────────────────┐\n                 │  Static Analysis  │\n                 │      Slither      │\n                 └─────────┬─────────┘\n                           │\n                           ▼\n                 ┌───────────────────┐\n                 │ Contract Context  │\n                 │ Functions / Calls │\n                 │ Security Signals  │\n                 └─────────┬─────────┘\n                           │\n                           ▼\n                 ┌───────────────────┐\n                 │   RAG Retrieval   │\n                 │ ChromaDB + Local  │\n                 │    Embeddings     │\n                 └─────────┬─────────┘\n                           │\n                           ▼\n                 ┌───────────────────┐\n                 │   Local Analyzer  │\n                 │  Qwen2.5-Coder    │\n                 └─────────┬─────────┘\n                           │\n                           ▼\n                 ┌───────────────────┐\n                 │  Skeptic Agent    │\n                 │ Independent Check │\n                 └─────────┬─────────┘\n                           │\n                 ┌─────────┴─────────┐\n                 ▼                   ▼\n        Exploit Analysis       Secure Generation\n                 │                   │\n                 ▼                   ▼\n             Foundry          Compile + Validation\n                 │                   │\n                 └─────────┬─────────┘\n                           ▼\n                    Final Results\n```\n\nBuilding SmartContractGuardian taught me that integrating Generative AI into a security application is not simply a matter of connecting an LLM to a prompt.\n\nThe difficult part is designing the surrounding system.\n\nI learned several important lessons.\n\nAn LLM can generate convincing explanations while still being wrong.\n\nSecurity systems need independent evidence and validation.\n\nAdding a vector database does not automatically make an AI system reliable.\n\nThe retrieved context has to be relevant, correctly chunked, and properly interpreted.\n\nSeparating analysis, skepticism, exploitation, generation, and validation makes the workflow easier to reason about and debug.\n\nCompilation, static analysis, and execution provide evidence that a language model cannot provide by itself.\n\nUsing an agentic IDE such as Google Antigravity changed my development workflow from simply writing individual functions to delegating larger engineering tasks, reviewing generated changes, testing them, and iterating.\n\nThe project was far from straightforward.\n\nSome of the biggest challenges included:\n\nThese challenges reinforced an important idea:\n\n**The engineering around an AI model is often as important as the model itself.**\n\nSmartContractGuardian is a research and development project, not a replacement for a professional smart-contract security audit.\n\nPassing static analysis or an AI review does not prove that a contract is completely secure.\n\nThere can always be vulnerabilities that the current rules, datasets, models, or validation procedures fail to detect.\n\nSimilarly, a successful generated PoC demonstrates a particular exploit path but does not represent every possible attack.\n\nThe goal of the project is therefore not to claim:\n\n\"AI can guarantee secure smart contracts.\"\n\nThe goal is:\n\nUse AI, retrieval, static analysis, and execution-based validation together to make smart-contract security analysis more powerful and actionable.\n\nThere are several directions I want to explore next.\n\nKeep sensitive contract analysis local while optionally using Gemini for higher-level explanations or interactive assistance.\n\nExpand the vulnerability dataset and evaluate detection performance systematically across different vulnerability categories.\n\nMeasure how often the Skeptic agent correctly rejects false positives and how much multi-agent verification improves precision.\n\nEvery improvement to the Analyzer or Generator should be evaluated against a fixed vulnerability benchmark to detect regressions.\n\nThe generator could move toward an iterative:\n\n**Generate → Analyze → Repair → Compile → Analyze Again**\n\nloop until the generated contract satisfies a defined validation policy.\n\nFuture versions could transform raw findings into clearer remediation reports explaining:\n\nSmartContractGuardian started with a simple question:\n\n**Can Generative AI help developers find and fix smart-contract vulnerabilities?**\n\nThe project evolved into something broader.\n\nIt combines:\n\n**Static Analysis + RAG + Local LLMs + Multi-Agent Reasoning + Exploit Validation + Secure Code Generation**\n\nThe biggest lesson from building it is that reliable AI applications need more than a powerful model.\n\nThey need evidence.\n\nThey need retrieval.\n\nThey need validation.\n\nAnd they need carefully designed workflows around the model.\n\nUsing Google Antigravity and its agentic development capabilities also gave me an opportunity to experience how AI can participate directly in the software-engineering process, from implementation and debugging to iteration and verification.\n\nSmartContractGuardian is my attempt to apply these ideas to one of the areas where reliability matters most: **blockchain security**.\n\n**GitHub:**\n\n[https://github.com/sayeedur007-design/SmartContractGuardian](https://github.com/sayeedur007-design/SmartContractGuardian)\n\n**Project:** SmartContractGuardian (VLD)\n\n**Focus:** AI-powered Solidity vulnerability detection, validation, and secure-contract generation\n\n**Core technologies:** Solidity, Python, Flask, React, Slither, Ollama, Qwen2.5-Coder, ChromaDB, RAG, LangChain, Foundry, Socket.IO, Google Antigravity IDE, and Antigravity SDK.\n\nThe project intentionally keeps its core security-analysis LLM workflow local while leaving room for optional integration with Google's generative AI ecosystem.", "url": "https://wpnews.pro/news/building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security", "canonical_source": "https://dev.to/sayeedur_rahman_8907d0d5d/building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security-1548", "published_at": "2026-08-26 14:29:19+00:00", "updated_at": "2026-08-26 14:44:43.002994+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-safety", "ai-tools", "developer-tools"], "entities": ["SmartContractGuardian", "Solidity", "Ollama", "GitHub", "Foundry", "RAG", "VLD"], "alternates": {"html": "https://wpnews.pro/news/building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security", "markdown": "https://wpnews.pro/news/building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security.md", "text": "https://wpnews.pro/news/building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security.txt", "jsonld": "https://wpnews.pro/news/building-smartcontractguardian-an-agentic-ai-approach-to-smart-contract-security.jsonld"}}