Cardano Auditors Dey Call for Continuous Reviews as Intersect Bounties No Get Funding

The September 28 discussion bring together Philip DiSarro of Midgard Labs, Santiago of TxPipe, Aleksandr of Tweag, Ben Hart of MLabs, and Leathers. Cardano Foundation’s Denicio Bute moderate the session, as dem examine how AI dey change both how people dey discover vulnerabilities and the kain work wey needed to defend Cardano applications.

AI Dey Divide Cardano Security Experts

Bute open the talk by asking whether the recent exploits for the Cardano ecosystem fit involve attackers wey use AI assist. DiSarro argue say current models dey give skilled attackers strong tools to examine code and pursue complex exploits. For im view, development teams need to dey test their own protocols again and again as those tools dey improve.

Hart challenge the idea say AI fit already do the work wey expert attacker or auditor go do on im own. For audits wey im use AI, na people still identify the most significant problems. Na human recognize the weakness for one product specification and design way to test am, even when model help produce the test code.

Leathers describe one practical limit from Intersect vulnerability reports. Submissions don increase sharply, but many no dey show real security issue. Im talk say the strongest reports still dey come from researchers wey get relevant expertise. The panel no offer case specific evidence wey confirm say people use AI for the Cardano exploits wey dem discuss during the session.

The speakers still reject the assumption say Cardano extended UTxO model dey make im applications hard for AI tools to analyze because those tools dey more familiar with EVM code. Leathers point to the available documentation for Cardano and Plutus. Cardano architecture dey prevent some classes of smart contract attack, but application fit still get flaws for im own logic or the surrounding systems.

Cardano Audits Fit Pass Smart Contracts

The discussion move from contract code to the full path wey application take to handle user funds. Servers, software libraries, wallet connections, signing devices, and administrative keys fit all affect the outcome of a transaction. Secure on chain validator no fit protect users from every failure for those components.

Hart talk say AI generated code don make specifications more important. If development team no fit describe precisely wetin their product suppose allow and wetin e suppose forbid, auditor no go get reliable standard to check the implementation. Santiago add say teams must define their threat model and decide how much flexibility or upgradeability dem want, because those choices fit introduce more ways to change system.

That work dey give tests and formal verification concrete purpose: to check whether the application dey preserve im stated rules. DiSarro argue say teams suppose go further by attempting controlled attacks against their own protocols. Reviews suppose also follow any meaningful changes to code, infrastructure, and operating procedures, instead of to rely indefinitely on one audit wey dem complete before launch.

The auditing firms describe AI as part of that process. Models fit scan for patterns, compare code with specifications, and suggest potential attack paths. Santiago talk say im team dey check automated findings through human review; the panel also discuss using more than one model because different tools fit uncover different issues. False positives still dey consume review time, while sensitive code and computing requirements dey affect whether team go use hosted or locally operated model.

Intersect Bug Bounty Program Dey Face Funding Gap

Leathers come identify separate problem for coordinated vulnerability disclosure. Im talk say bug bounty funding no get approval for the current treasury cycle. Researchers still fit submit reports, and the Security Council still dey examine dem, but dem no fit presently pay new rewards through that funding route. Im talk say the council dey work with Intersect on alternatives and say community approved treasury withdrawal fit provide funding.

Intersect launch im bug bounty program in 2025 for infrastructure and tools wey e manage or sponsor. Smart contracts dey inside scope only when dem explicitly include am. Leathers remarks concern that program; the Cardano Foundation dey operate separate bounty arrangement.

Higher volume of AI generated reports still dey raise the cost of reviewing submissions. Leathers call for stricter triage so that reproducible vulnerabilities go get attention, while incorrect findings and ordinary maintenance issues go dey classify appropriately. DiSarro separately urge individual DeFi protocols and bridges to set their own rewards and incident procedures before exploit go happen.

The roundtable leave Intersect with one defined governance question. Im disclosure channel still open and the Security Council still dey assess reports. Funding for researcher rewards now depend on new arrangement or treasury decision. That decision go determine whether valid finding under Intersect program fit again lead to the payment wey the program design to offer.