AI Audit vs Code4rena veRWA: 8/8 HIGH Reproduced

Vote-escrow governance is a specific kind of nightmare to audit. Locks, epochs, weight decay, delegation, gauge systems — the bugs live in the interaction between time and state, not in individual functions. veRWA's Code4rena 2023-08 contest surfaced eight HIGH-severity findings across 754 lines of Solidity. Our AI engine ran against the same codebase and detected every one.

The Results

This is the kind of protocol where pattern-matching scanners produce noise without signal. You need an engine that reasons about temporal state, role hierarchies, and adversarial incentives. That is what we built.

The Target: veRWA Governance

veRWA is a Curve-style vote-escrow governance system adapted for real-world asset gauges. It consists of four contracts tightly woven together:

Every HIGH-Severity Finding

Every one of C4's HIGH-severity findings was caught. Six of the eight were graded HIGH by our severity calibrator; two were graded Medium.

On the two Medium-graded HIGHs

H-07 (public checkpoint griefing) and H-08 (removed-gauge power lock) are real bugs with real user impact, but neither drains funds by itself. Our calibrator treats findings that require additional user action to exploit, or that result in disenfranchisement rather than direct theft, as Medium by default. C4's wardens rated them HIGH. Both views are defensible; we lean stricter.

The important point: the bugs were detected. A reader can see the full technical description, the attack path, and a concrete fix in the report — regardless of the numeric rating.

An Additional HIGH-Severity Issue Not in the Contest's HIGH/MEDIUM Report

Our engine identified a division-by-zero in LendingLedger.claim() that permanently DoS's reward claims when any epoch in the claim range has zero total market balance. This is reachable any time a market briefly empties out — all lenders withdrawing simultaneously, or a deposit-then-withdraw within the same epoch. Once reached, the user cannot claim any further rewards without forfeiting everything up to the zero-balance epoch.

We ship a passing Foundry PoC for it. We have not exhaustively checked C4's QA / Low-severity submissions; if a warden flagged this at a lower severity it would not appear in the HIGH/MEDIUM report we benchmarked against.

The New Detection Stack

This benchmark runs on our current production pipeline:

• Multi-tool static analysis — Slither + Mythril + Aderyn run in parallel for each audit. Each catches a different class of bug; aggregating them eliminates single-tool blind spots.
• Protocol-class specialist checklists — The engine identifies the protocol family (vote-escrow, lending, AMM, oracle consumer) from the code and auto-injects the 12-section specialist checklist of well-known footguns for that family. veRWA triggered the vote-escrow, epoch-reward, and lending checklists together.
• Attacker-persona reasoning — A dedicated agent reframes the codebase from the attacker's side: "I have $1M of capital; where does the money go?" Catches motivation-driven bugs that defensive scanners miss.
• Multi-step flow analysis — Separate agent dedicated to finding bugs that require 2-4 function calls to trigger. This is how we detect the delegation deadlock and the lock-extension grief.
• Cross-check ensemble — Every HIGH and CRITICAL finding is reviewed by a second model to independently validate the attack path. Report 5 saw three findings independently confirmed with 0.95 confidence.
• Proof-of-concept verification — Foundry test harnesses are auto-generated for every HIGH finding, compiled, and executed. If the exploit doesn't reproduce, the finding is flagged for human review before publication.

The Honest Comparison

What This Means in Practice

Our engine now matches Code4rena's published HIGH coverage on governance protocols and surfaces additional issues beyond the contest's HIGH/MEDIUM report. For a team shipping governance code, this is the difference between a one-shot audit at launch and continuous security monitoring on every commit.

Try It Yourself

Governance protocols are where bugs cost the most. We published our detection rate against a real, scored benchmark. Ask your current auditor for theirs.

Related reading

Wildcat Protocol (6/6 HIGH) · BakerFi (7/7 HIGH) · VTVL (5/5 findings) · Karak Restaking · Ethernaut + DVD (7/7) · Jito Restaking on Solana. For the full methodology, read RedVolt benchmark results.

Audit Your Smart Contract · Request an Expert Proof Report