Quantstamp


                    
                    Experts say AI has huge potential in smart contract audits and crypto security in future. Unfortunately, ChatGPT sucks at it right now.
                    Every day this week were highlighting one genuine, no bullsh*t, hype free use case for AI in crypto. Today its the potential for using AI for smart contract auditing and cybersecurity, we’re so near and yet so far. AI artwork for the ChatGPT written TurboToad memecoin. (Twitter)One of the big use cases for AI and crypto in the future is in auditing smart contracts and identifying cybersecurity holes. Theres only one problem  at the moment, GPT-4 sucks at it.Coinbase tried out ChatGPTs capabilities for automated token security reviews earlier this year, and in 25% of cases, it wrongly classified high-risk tokens as low-risk.James Edwards, the lead maintainer for cybersecurity investigator Librehash, believes OpenAI isnt keen on having the bot used for tasks like this.I strongly believe that OpenAI has quietly nerfed some of the bot’s capabilities when it comes to smart contracts for the sake of not having folks rely on their bot explicitly to draw up a deployable smart contract, he says, explaining that OpenAI likely doesnt want to be held responsible for any vulnerabilities or exploits.This isnt to say AI has zero capabilities when it comes to smart contracts. AI Eye spoke with Melbourne digital artist Rhett Mankind back in May. He knew nothing at all about creating smart contracts, but through trial and error and numerous rewrites, was able to get ChatGPT to create a memecoin called Turbo that went on to hit a $100 million market cap.gm  As someone with zero Solidity proficiency, I had an already efficient smart contract tailored to my own needs by AI.I dumped @Azuki's smart contract into GPT-4 and had it ask me relevant questions. Disclaimer: Professional human audits and devs are still important to pic.twitter.com/K4UGfFC5dp— SV (@0xSMV) March 16, 2023But as CertiK Chief Security Officer Kang Li points out, while you might get something working with ChatGPTs help, its likely to be full of logical code bugs and potential exploits:You write something and ChatGPT helps you build it but because of all these design flaws it may fail miserably when attackers start coming. So its definitely not good enough for solo smart contract auditing, in which a tiny mistake can see a project drained of tens of millions  though Li says it can be a helpful tool for people doing code analysis.Richard Ma from blockchain security firm Quantstamp explains that a major issue at present with its ability to audit smart contracts is that GPT -4s training data is far too general.Also read: Real AI use cases in crypto, No. 1  The best money for AI is crypto“Because ChatGPT is trained on a lot of servers and theres very little data about smart contracts, it’s better at hacking servers than smart contracts,” he explains.So the race is on to train up models with years of data of smart contract exploits and hacks so it can learn to spot them.       Read also                                                                              Features                            Risky business: Celsius crisis and the hated accredited investor laws                                                                                                                    Features                            Space invaders: Launching crypto into orbit                                            “There are newer models where you can put in your own data, and that’s partly what we’ve been doing, he says. “We have a really big internal database of all the different types of exploits. I started a company more than six years ago, and weve been tracking all the different types of hacks. And so this data is a valuable thing to be able to train AI.Race is on to create AI smart contract auditorEdwards is working on a similar project and has almost finished building an open-source WizardCoder AI model that incorporates the Mando Project repository of smart contract vulnerabilities. It also uses Microsofts CodeBert pretrained programming languages model to help spot problems.According to Edwards, in testing so far, the AI has been able to “audit contracts with an unprecedented amount of accuracy that far surpasses what one could expect and would receive from GPT-4.The bulk of the work has been in creating a custom data set of smart contract exploits that identify the vulnerability down to the lines of code responsible. The next big trick is training the model to spot patterns and similarities. Ideally you want the model to be able to piece together connections between functions, variables, context etc, that maybe a human being might not draw when looking across the same data.”While he concedes its not as good as a human auditor just yet, it can already do a strong first pass to speed up the auditors work and make it more comprehensive.“Sort of help in the way LexisNexis helps a lawyer. Except even more effective,” he says. Dont believe the hypeNear founder Illia Polushkin is an expert in both AI and blockchain. Near co-founder Illia Polushkin explains that smart contract exploits are often bizarrely niche edge cases, that one in a billion chance that results in a smart contract behaving in unexpected ways.But LLMs, which are based on predicting the next word, approach the problem from the opposite direction, Polushkin says.“The current models are trying to find the most statistically possible outcome, right? And when you think of smart contracts or like protocol engineering, you need to think about all the edge cases,” he explains.Polushkin says that his competitive programming background means that when Near was focused on AI, the team developed procedures to try to identify these rare occurrences.It was more formal search procedures around the output of the code. So I don’t think it’s completely impossible, and there are startups now that are really investing in working with code and the correctness of that, he says.But Polushkin doesn’t think AI will be as good as humans at auditing for the next couple of years. It’s gonna take a little bit longer.Also read: Real AI use cases in crypto, No. 2  AIs can run DAOs    Subscribe    The most engaging reads in blockchain. Delivered once a        week.         Email addressSUBSCRIBE    

Real AI use cases in crypto, No. 3: Smart contract audits & cybersecurity


                    
                    The blockchain-based investment note is issued on Avalanche and will automatically distribute profits to holders’ wallets.
                    Neo-investment and technology firm Republic plans to issue a blockchain-based security token that will pay dividends to retail investors from profits across its broad portfolio of investment holdings.The Republic Note is a profit-sharing digital asset that will be launched on the Avalanche blockchain, which accrues profits generated from Republic’s wide-ranging investment portfolio and services. Republic has attracted over three million investors and has deployed over $2.6 billion into various ventures, including the likes of Web3 firms Avalanche, DappRadar and Dapper Labs.Republic has already carried out a presale round for the Republic Note, attracting over $30 million from individual and institutional investors. Dividends from the note are set to be paid out in USD Coin (USDC) to retail investors when the dividend pool reaches a threshold of $2 million. Related: Over 6,000 participants help Republic Note rocket past $8 million targetRepublic has also developed a proprietary Web3 self-custodial, cross-chain wallet that will be used to distribute dividends to Republic Note holders. The notes will not be tradeable digital assets like other cryptocurrency tokens and are set to be listed on select securities exchanges in the next two to three months. Republic president Andrew Durgee highlighted the selection of Avalanche as its blockchain platform of choice as primarily driven by the company’s ambition to reach and scale a broad audience of Web3 native investors:“Choosing Avalanche goes far beyond the network’s strength, scale, and speed — it solidifies our longstanding partnership with Ava Labs, built on a shared vision of more inclusive financial markets.”The Republic Note has been a work in progress since 2016 when its white paper was first published. Quantstamp has since audited the digital securities offering. The website for the upcoming digital security lists the price of a single Republic Note at $0.36. Between 330 and 350 million Republic Notes will be circulating at launch, with the total Republic Note supply capped at 800 million. As Cointelegraph recently reported, other cryptocurrency ecosystem players have also launched tokenized securities offerings to prospective investors.Blockchain technology firm Blockstream announced the launch of the Blockstream ASIC Note in August 2023, which allows investors to gain exposure to digital securities paid for in Bitcoin (BTC) that will be used to buy ASIC mining hardware at scale. Blockstream plans to store and sell the hardware back to the market as demand for ASIC miners picks up into 2024.Magazine: An investment in knowledge pays the best interest: The parlous state of financial education

