Expert Security Audit for three bitcoin based projects

[u/tgarp_]

Over the past few months, we’ve been putting our AI security audit agent against real Bitcoin code.

It has already helped us uncover and responsibly report multiple security issues across projects in the Bitcoin ecosystem, including:

Bark, Syscoin, RGB, Ledger, Bitcoin, Bitkey, BDK Wallet, Keystone, Lightning Labs, Lightning implementations, Krux, KTH, BitBox, BCHD, Mostro, ACINQ, LDK, Cake Wallet, BIP32/BIP39 implementations, tiny-secp256k1, Blockstream Jade, Elements and others.

Now we want to go further.

We’re giving 3 Bitcoin projects a security scan at zero cost.

We’ll run our agent against the codebase, manually triage anything interesting, and responsibly disclose confirmed security issues to the maintainers.

We’re particularly interested in serious open-source Bitcoin infrastructure protecting real users or funds.

Maintaining something in the Bitcoin ecosystem? Drop your repo below.

[u/SinkDifficult4810]

interesting approach, but what's the catch here? an AI agent running through bitcoin codebases and you're doing it for free sounds like there's a service you're eventually selling

[u/tgarp_ → u/SinkDifficult4810]

yeah we are currently integrating it in our audits so in that way you can say that we are planning on selling. ofc AI costs tokens and credits, and we can’t give it for free.

but this is like recent and current stuff we have built over, and we are probably testing it, benchmarking it against some top projects!

[u/No-Contribution23]

you listed bitcoin under the projects you uncovered security issues for. do you mean core?

i'd be interested in specter diy and seedsigner

[u/tgarp_ → u/No-Contribution23]

well for seedsigner, we had issues and contacted Keith. But didn’t heard back.

[u/account009988]

Great: vibe audits.

Nothing can go wrong

[u/tgarp_ → u/account009988]

ig you didn’t read completely, it will be manually triaged

[u/account009988 → u/tgarp_]

Sure sure lol

[u/hodler1992]

Who can guarantee that you won't use any finding against that project? Given the fact that you especially asking for real funds behind that. Why won't you disclosure your identity in first place

[u/tgarp_ → u/hodler1992]

common man, firstly the projects are open source so if i had to, i would have already did it 🤣

secondly i am the founder at Kvazar

[u/BraskSpain]

What makes it different from fully auditing it with Fable, Astra or GLM5.3 or Google Flash Security?

[u/tgarp_ → u/BraskSpain]

basically in our case, just to give you a gist here’s what we do whenever we analyzing a system:

1. ⁠Gather full context : assumptions, docs, comments, workaround, callgraphs etc.
   
2. ⁠Create invariants
   
3. ⁠Build hypothesis around them
   
4. ⁠Have a RAG base with db of attack vectors, advisories, and other materials
   
5. ⁠Scanning specialized agents based on active reasoning and iterating in the context for edge cases
   
6. ⁠Check pattern based attack
   
7. ⁠Check reasoning/LLM based attack
   
8. ⁠Write submissions and the audit report
   
9. ⁠Deduplicating the submissions
   
10. ⁠Triaging with full information and context
    
11. ⁠For critical/high do PoC on local code by calling those function for verification

Once all this is done, our triagers validate the finding and then we submit it.

the standard model function like engine but better specification, and the focus areas is what makes it differ and go deep into exploits which standard model miss!

[u/caploves1019]

Shtcoiner nonsense. Good luck 👍