Back to Hub
CREATED BY CHAINLINK LABS

AI Smart Contract Audit Firewall

Automatically analyze and screen smart contract interactions before execution to detect and block malicious transactions, while preserving the confidentiality of chain scanner and LLM reasoning API credentials.

Get the template
cre init --template=ai-audit-firewall-ts
View on GitHub

This standalone CRE project implements a confidential pre-execution security firewall for smart contract interactions.

Description

The workflow screens proposed transactions before they are allowed to proceed. It fetches and validates contract intelligence, runs confidential reasoning to classify risk, and then enforces a firewall decision path. Scanner and model credentials remain protected inside confidential execution throughout the process.

Target Customer

  • Professional retail traders
  • Developer shops
  • Founders building trading products

Structure

  • project.yaml: project-level target settings
  • secrets.yaml: secret ID mappings used by the workflow
  • mock-server.js: local deterministic API server
  • ai-audit-firewall-ts/: TypeScript workflow implementation
  • ai-audit-firewall-go/: Go workflow implementation

Private Inputs

The following inputs are handled as confidential:

  • Chain scanner API credentials used for contract metadata retrieval and verification checks.
  • LLM reasoning API credentials used for independent audit analysis.

Workflow Notes

  1. Monitor and ingest the proposed interaction. The workflow receives candidate transaction context, including token and protocol contract addresses.
  2. Fetch and validate contract data confidentially. It retrieves source and ABI artifacts through the scanner and verifies scanner credential permissions before trusting fetched data.
  3. Run smart contract audit analysis. The workflow submits context to multiple reasoning models and classifies behavior into structured risk signals:
    • obfuscatedTax
    • privilegeEscalation
    • externalCallRisk
    • logicBomb
  4. Enforce firewall action and record outcomes. Based on aggregate risk, the workflow allows execution, blocks malicious interactions, or routes the attempt for manual review while preserving audit and action logs.

Note: Any reasoning stage can be replaced with deterministic rule-based logic if a purely policy-engine implementation is preferred.

Required Environment Variables

Copy .env.example to .env and provide values for:

  • CRE_ETH_PRIVATE_KEY (optional for local simulate, required for real chain writes)
  • MOCK_PORT
  • MOCK_SCANNER_API_KEY
  • MOCK_PRIMARY_LLM_API_KEY
  • MOCK_SECONDARY_LLM_API_KEY

The local mock server for this project only exposes routes under /audit-firewall/*.

Quick navigation:

TypeScript Quick Start

  1. Install dependencies
bun install
  1. Create environment file
cp .env.example .env
  1. Start mock server
bun run mock:server
  1. In another terminal, run checks
bun run typecheck
bun run test
  1. Simulate workflow
cre workflow simulate ./ai-audit-firewall-ts --target=staging-settings

Go Quick Start

  1. Create environment file (at the shared project root)
cp ../.env.example ../.env
  1. Start the mock server (requires Node or Bun)
bun mock-server.js
  1. In another terminal, run checks
go vet ./...
go test ./...
  1. Simulate workflow
cd .. && cre workflow simulate ./ai-audit-firewall-go --target=staging-settings

Get the latest Chainlink content straight to your inbox.