forefy

AI Summary of my talk at ETHDenver 2026 🥳 ⤵️⤵️ The talk focuses on why deterministic tooling still matters in a world where everyone uses AI for security reviews. 🤖 The AI Audit Problem - Developers blindly use AI (Claude, Copilot) to generate and review code, including security tests - without fully understanding what's produced. - Even professional security auditors are vibe-auditing with AI, making it hard to trust audit results. - This creates a trust gap in the entire smart contract security ecosystem. 🔍 What Radar Does - A CLI-based static analysis tool supporting Solidity and Rust (including Stylus/Anchor). - Template-based design inspired by Nuclei (popular web2 scanner) - but a better engine as researchers write Python rules - Designed for scale: scanning 200+ contracts simultaneously, ideal for continuous monitoring or mass vulnerability hunting. 🐍 Why Python Templates? - YAML (like Nuclei used) got unreadable at scale. Python is more readable and, critically, AI generates better Python than Rust for this use case. - Templates are deterministic, shareable, and reviewable - unlike asking an LLM "find bugs in my contract" which gives different answers each time. - Built-in sandboxing strips dangerous Python operations (no network calls, no subprocess), making community templates safer to run. ⚡ The Workflow Vision 1. Security researcher discovers a bug pattern during an audit. 2. Uses AI (with human oversight) to generate a Radar template encoding that pattern. 3. Tests, reviews, and optionally shares the template with the community. 4. Others (or automated systems) spray the template across thousands of contracts. 5. Replaces "I found one bug in one contract" → "I found this bug class across the entire ecosystem." 🌐 Web3 Analogy to Reac2Shell - In web2, within hours of a CVE dropping, Nuclei templates appear for community scanning. - Radar wants the same for web3 - rapid, trustworthy, community-driven detection at scale. - Also addresses the malware risk of rushing to run sketchy Python scripts (e.g., fake "check if you're vulnerable" scripts that steal API keys). 🦀 Current State & Call to Action - ~30 templates today, aiming for thousands. - Radar is open source, one command to self-host on a VPS. - Researchers can keep private templates for personal bounty hunting and contribute when patterns are exhausted. - Looking for contributors and template writers.

No one's talking on how Claude Routines just destroyed whatever recurring scan/task/service you were building - 0 setup free cloud compute to run periodic AI tasks - pay for tokens only - security is up to speed (define isolated plugins only, session has nothing that you don't define) - free init script code control - auditable run logs - integrations are taking 2 clicks avg Amazing

Anthropic pulling Fable off the subscriptions..

If you missed the Zig/Bun drama, here's a recap.