Original source: Beosin

On June 9, Anthropic officially launched the public version of Mythos Claude Fable 5. Previously, Mythos had outstanding capabilities in security vulnerability mining, quickly detecting hidden vulnerabilities within systems, attracting significant attention in the field of cybersecurity.

Recently, the Zcash incident is a typical example of AI mining blockchain vulnerabilities. Security researcher Taylor Hornby, using the Anthropic Claude Opus 4.8 model, discovered a dormant vulnerability in the Orchard privacy pool soundness that had been undetected for four years and missed in multiple manual audits. This vulnerability theoretically allowed for the minting of unlimited undetected fake ZEC, directly causing the ZEC price to plummet nearly 40%.

Currently, AI has demonstrated astonishing efficiency in code pattern matching and bulk preliminary screening, integrating AI into blockchain and smart contract security audit processes is becoming a trend in the Web3 security industry. This article will analyze the advantages and shortcomings of AI in smart contract auditing, combining real vulnerability cases and the performance of Fable 5.

AI Audit Advantage Scenarios

Case Analysis: Storage Slot Collision

A certain contract uses the following two components:

1. A custom rewards mapping (used to record rewards available for users to claim)

2. The ReentrancyGuard from the Solady library (to prevent reentrancy attacks)

However, the storage layout of the two components conflicted.

The ReentrancyGuard from Solady used fixed, low-numbered storage slots for maximum gas optimization (usually obtaining a slot close to a constant through specific calculations). The typical logic of the nonReentrant modifier is:

// A simplified versionmodifiernonReentrant() { // when entering, write guard slot as 0xff...ff（Sentinel Value）  assembly {   ifeq(sload(REENTRANCY_GUARD_SLOT),2) {revert(...) } // 2 represents locked   sstore(REENTRANCY_GUARD_SLOT,2) // locked  }  _; // recover when function finishes  assembly {sstore(REENTRANCY_GUARD_SLOT,1) }}

Custom rewards mapping:

mapping(address=>uint256)publicrewards;

Due to the Solidity storage layout rules (the first slot of a mapping is calculated based on its declaration position), the first slot of the rewards mapping is identical to the fixed protection slot of the ReentrancyGuard.

Attack process (detailed steps):

1. The attacker calls the getReward() function

2. The nonReentrant modifier is triggered, writing the guard slot to 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff (all 1s)

3. The contract code subsequently reads rewards[attacker address] — but due to the slot collision, it actually reads the oversized value of 0xff...ff from the guard slot

4. The contract believes "there is a huge reward," so it transfers this ETH to the attacker while attempting to zero out rewards[attacker] (but ends up writing back to the same guard slot)

5. Because the modifier will restore the slot at the end of the function, when the attacker calls getReward() again, the process repeats

6. The attacker loops the call 200 times, successfully extracting a fixed amount of ETH each time until the ETH available for withdrawal in the contract is drained

It is important to note that this is not a traditional "reentrancy attack," but rather the ReentrancyGuard's own protection mechanism being exploited through a storage collision, turning into a vulnerability for infinite claiming. Manual audits rarely delve line by line into the storage layout of third-party libraries, while AI can instantly complete library version comparisons and precise slot mapping, directly hitting these "hidden collision" vulnerabilities.

AI Audit Disadvantage Scenarios

Fable 5 performs excellently in single contract, pure code syntax, and underlying storage-type vulnerability detection, but there are still significant limitations when facing cross-protocol combination semantics and multi-contract combination attacks. We used the latest public version Fable 5 to retest the relevant contracts related to the Curve LlamaLend sDOLA attack event, and the results confirmed this issue.

This audit involved the following contract list: crvUSD Controller.vy, sDOLA.sol, ERC4626.sol, among other related contracts. However, Fable 5 failed to identify the core risks corresponding to this attack:

This event is a typical cross-protocol combination vulnerability, where the single contract code syntax and logic have no issues, but the attacker constructs an attack chain using multi-protocol interactions:

1. Using a flash loan tool, manipulate the price of the Curve liquidity pool to maliciously lower the asset price of sDOLA (ERC-4626 vault share);

2. A large number of loan positions collateralized by sDOLA trigger liquidation thresholds;

3. The attacker executes liquidation operations in bulk to profit.

These types of vulnerabilities rely on the combination of multiple DeFi protocols, testing the comprehensive analytical capabilities of AI/audit experts regarding the overall business and protocol economic models, and current AI audits are still lacking in cross-protocol combination semantics.

Conclusion

Through actual case testing, it can be seen that Fable 5 effectively uncovers hidden vulnerabilities that manual audits easily overlook in standardized and detailed scenarios such as storage slot conflicts, code pattern vulnerabilities, single contract logic defects, and bulk code preliminary screening. However, it struggles to understand the essence of on-chain ecosystem businesses and uncover combination attack paths when handling cross-protocol combination semantics, DeFi economic models, multi-contract interactive attacks, and complex business logic vulnerabilities, which still require analysis led by professional security auditors.

In daily audit work, Beosin has established a mature audit process that collaborates AI with security audit experts, significantly enhancing audit efficiency and better identifying potential detailed risks and complex business logic vulnerabilities, making the audit work more efficient, comprehensive, and in-depth.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。