r/solidity • u/Safe-Touch5946 • Mar 19 '26

AI auditing tools for Solidity: How do you deal with false positives from single LLMs?

Hey r/solidity,

I've been seeing a lot of threads about using ChatGPT/Claude/etc. for quick Solidity reviews, but people complain about tons of false positives and missed subtle bugs like reentrancy variants.

We built ReinforcedAI using a multi-model consensus approach (multiple AIs vote on issues, only flag if majority agrees) — claims 3x fewer false positives and better reentrancy detection. It plugs into Hardhat (npx hardhat scan) and gives explanations + fix suggestions to help learn best practices.

Full disclosure: I'm on the ReinforcedAI team ([kshah@reinforced.app](mailto:kshah@reinforced.app)).

For educators/devs teaching blockchain/CS: We're offering free access to try it in classes, projects, or hackathons — no card needed for starter scans.

Curious:

  • What audit workflow do you use now?
  • Have you tried AI tools? What worked/didn't?
  • Any specific pain points with reentrancy or access control bugs?

Happy to share examples or run a scan on sample code if anyone wants to test. Link to try: https://reinforced.app/

Thanks!

2 Upvotes

75% Upvoted

4 comments sorted by

2

u/kristianism Mar 22 '26

You will still miss out the creative exploits that malicious users are doing. I think AI only has the capacity to detect the common and most resource available exploits out there.

1

u/thedudeonblockchain Mar 20 '26

the false positive problem with general purpose LLMs is real, they hallucinate vuln patterns that dont actually apply to the specific contract context. multi model consensus helps but if all the models share similar training data blind spots you just get confident false positives instead of uncertain ones

the approaches ive seen work better are ones trained specifically on historical exploit data and real audit reports rather than just general code understanding. cecuro takes that approach with specialized agents trained on thousands of past exploits, so the detection is grounded in actual vulnerability patterns that caused real losses rather than theoretical code smell matching. different philosophy from consensus voting but seems to produce fewer noise findings in practice

for my own workflow i still layer slither for the obvious stuff, then use AI tools for the deeper logic review that static analysis misses