audit-coder-7b-v1

Give it smart-contract code and it returns a list of possible vulnerabilities (hypotheses) as JSON. Runs locally with Ollama, so your code stays private.

Mainly Solidity; it also saw some Rust (about 5% of training).

Status: experimental. Results on unseen projects are not published yet. Every hypothesis is a lead to check, not a finding. Prove each one with a test before you report it.

Quick start

You need Ollama.

pipx install huggingface_hub    # or: pip install -U huggingface_hub (inside a venv)
hf download edoggy/audit-coder-7b-v1 --include "*.gguf" --local-dir ~/audit-v1
hf download edoggy/audit-coder-7b-v1 Modelfile --local-dir ~/audit-v1
cd ~/audit-v1
ollama create audit-7b-v1 -f Modelfile

Use ollama create with the Modelfile, not ollama run hf.co/.... The Modelfile holds the system prompt the model was trained with; without it you get a generic chat model.

Then point it at a contract:

ollama run --nowordwrap audit-7b-v1 "$(cat src/Vault.sol)" > hypotheses.json

Keep the input under about 12,000 tokens (one or a few related contracts). Larger inputs get cut off.

Output

{"hypotheses": [
  {"title": "...", "severity": "high", "confidence": "medium",
   "contract": "Vault", "function": "withdraw", "vuln_class": "...",
   "description": "who calls what, in what order, and what goes wrong"}
]}

Training

LoRA on Qwen2.5-Coder-7B-Instruct, trained on High and Medium findings from 125 past Code4rena audits, paired with the code they were found in. The adapter is in adapter/ if you want to merge or train further. Credit to the wardens who found the bugs.

Limits

• It suggests bugs; it doesn't prove them. Expect false positives.
• Only sees the code you give it, not the whole protocol, unless you include it.
• Check your bounty platform's rules on AI-assisted work.