Scaling Smart Contract Security with AI I Shashank

Sun, Nov 2, 2025, 12:00 AM

Shashank, founder of SolidityScan, explains how AI and automation are transforming smart contract security. With over 14 years in cybersecurity (credited with finding bugs in Apple, Google, and Facebook), he highlights the staggering scale of Web3 hacks—over $5B in 2024, with 55% caused by contract vulnerabilities—and argues that manual audits alone can’t scale. He demonstrates how AI-powered automation reduces false positives and identifies nuanced access-control issues. Using the 2022 ShadowFi token hack as a case study, Shashank shows how traditional rule-based scanners struggle with logic-based bugs, while AI understands contextual security patterns. He details how SolidityScan’s multi-agent AI model, trained on 100K+ audit reports, mimics an “AI auditor” in developers’ CI/CD pipelines—reducing false positives by 82% and enabling real-time vulnerability detection before deployment. 00:02 Introduction & context: AI + blockchain security 00:27 Shashank’s background in cybersecurity (Apple, Google, Facebook) 00:59 Web3 security challenges: hacks & financial losses 01:28 Birth of SolidityScan: AI-powered contract analysis 02:00 Why automation is needed: billions lost, manual audits can’t scale 02:45 CI/CD security comparison to Web2 03:09 Rule-based scanning limitations → need for AI 03:27 Case study: ShadowFi token hack (Sept 2022) 04:10 Transaction analysis: token burn exploit explained 05:21 Access control vulnerabilities as #1 cause 05:44 How missing modifiers caused the exploit 06:08 Why rule-based systems fail to catch custom RBAC patterns 06:59 Example: false positives in static scanning 07:32 Using AI to understand code context & access logic 08:05 Results: 82% reduction in false positives 08:57 Multi-agent AI: master/slave setup & specialized agents 09:30 Dataset: 100K+ audit reports, 1M+ vulnerabilities 10:01 How the AI auditor works in developer pipelines 10:25 Audience Q&A: context limits, hallucinations, AI-guided algorithms 11:50 Future plans: formal verification & AI-generated fuzzing tests 12:10 Static analysis today, dynamic verification next 12:43 Closing remarks _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 🇮🇳 *Pragma New Delhi* Pragma New Delhi 2025 was held on September 25th at the JW Marriott Hotel in Aerocity New Delhi and was an in-person summit for builders and leaders in the web3 ecosystem. Watch the full Pragma New Delhi YouTube Playlist here: ETHGlobal's Pragma series takes place in cities around the world, and is designed to be a different kind of event. Pragma is a one-stage conference with founders-only on stage, bringing together a small group of curated attendees and speakers to discuss the future of web3 and reflect on the past. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ✅ Follow Shashank X: https://x.com/cyberboyIndia ✅ Follow Credshields X: https://x.com/credshields ✅ Follow ETHGlobal X: https://x.com/ETHGlobal​ Warpcast: https://warpcast.com/ethglobal Website: https://ethglobal.com YouTube: https://www.youtube.com/@UCfF9ZO8Ug4xk_AJd4aeT5HA _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Are you interested in Ethereum development and entrepreneurship? 👉 Sign up for the next ETHGlobal event: https://ethglobal.com/events 🎁 Get exclusive access and perks with ETHGlobal Plus! https://ethglobal.com/plus 📣 Want us to throw an event in your city? Tell us where! https://ethglobal.com/city _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _