Overview
DynaAudit is a multi-agent smart contract auditing system that addresses a critical gap in existing LLM-based tools: static knowledge bases cannot detect vulnerabilities from exploits that occur after model training cutoffs. Over $2.6 billion USD was lost across 192 smart contract exploits in 2024 alone. DynaAudit combines four specialized AI agents with a dynamic RAG pipeline that continuously ingests live on-chain exploits — detecting both known and emerging vulnerabilities with confidence scoring and severity classification.
The Problem
- ▹Smart contracts on Ethereum are immutable once deployed — bugs cannot be patched post-deployment
- ▹Over $2.6B USD lost across 192 exploit incidents in 2024 alone
- ▹Existing LLM-based tools rely on static training data and miss new exploit patterns post-cutoff
- ▹A single LLM auditor suffers from degeneration-of-thought — it becomes biased toward its initial analysis
The Four-Agent Audit Team
Project Manager
Orchestrates the audit — sets objectives, initiates subtasks, tracks progress
Smart Contract Auditor
Primary analyst — identifies vulnerabilities using Dynamic RAG context
Solidity Programming Expert
Deep code-level analysis — integrates Slither & Mythril static tool output
Smart Contract Counselor
Validator & reporter — challenges findings, deduplicates, writes the final structured report
3-Phase Audit Loop
Contract Analysis
PM ↔ SCA: Understand contract purpose, structure, and entry points. RAG injection adds top-K similar exploits into SCA context.
Vulnerability Identification
SCA ↔ SPE (role reversal): Forces SPE to independently re-evaluate findings, eliminating confirmation bias and degeneration-of-thought. Slither & Mythril output fed into SPE reasoning.
Report Generation
SCC validates, deduplicates, and produces the final report. Diff Detector flags vulnerabilities matching newly-added exploits not in GPT's static training data.
DynaAudit vs LLM-SmartAudit (Baseline)
| Feature | LLM-SmartAudit | DynaAudit |
|---|---|---|
| Knowledge base | Static (training cutoff) | Dynamic — live on-chain exploits |
| Exploit sources | None | Etherscan, Forta, Rekt.news, DeFiHackLabs |
| Vulnerability detection | Known patterns only | Known + emerging (post-cutoff) |
| Confidence scoring | Binary (yes/no) | Scored with severity levels |
| Diff detection | Not present | Flags novel vs. known exploits |
| Feedback loop | None | Continuous re-ingestion of new exploits |
Tech Stack
View Source
Research project — extending LLM-SmartAudit (IEEE TSE, 2025).