The Good Tech Companies - AI Auditor Flags $2M Smart Contract Bug Before Launch

Episode Date: October 1, 2025

This story was originally published on HackerNoon at: https://hackernoon.com/ai-auditor-flags-$2m-smart-contract-bug-before-launch. An overlooked math error in lending code could have drained millions. It was caught by an AI tool before launch - a sign of how automated auditors are beginning Check more stories related to web3 at: https://hackernoon.com/c/web3. You can also check exclusive content about #web3, #sherlock, #btcwire, #press-release, #ai, #blockchain-development, #crypto-exchange, #good-company, and more. This story was written by: @btcwire. Learn more about this writer by checking @btcwire's about page, and for more stories, please visit hackernoon.com. Vulnerability that would have drained $2 million from decentralized lending protocol was spotted by an AI auditor. The audit was made by Sherlock AI, part of a wave of automated systems entering the security process.

This audio is presented by Hacker Noon, where anyone can learn anything about any technology. AI Auditor flags $2 million smart contract bug before launch by BTC Wire. A vulnerability that never reached main net weeks before a leading decentralized lending protocol was set to launch, an ioditor flagged a vulnerability that would have allowed attackers to quietly siphon off funds. The flaw was simple in design but severe in impact. The withdrawal function rounded tiny transactions down to, zero in user balances while still sending tokens from reserves. By repeating the action in an

automated loop, an attacker could have drained the pool entirely, nearly $2 million in total value locked, TVL, even with a zero balance. Had the bug made it to Mainet, the consequences would have been immediate, withdrawals would fail, lending would seize up, and depositors would discover that reserves no longer matched deposits. To say that the ramifications would have been bad would be an understatement. Instead, the exploit was patched before deployment. The discovery didn't come from a human team, but from Sherlock AI part of a wave of automated systems no entering the security process. How smart contract auditing typically works smart contract audits are a standard pre-launch ritual in Defi. Protocols hire human engineers to review code, function by function,

in search of weaknesses. These audits have stopped countless vulnerabilities from ever-reaching production, but they are constrained, expensive, timely, and ultimately dependent on human focus. With protocols growing in size and complexity and billions in user deposits at stake, the industry has been forced to look for new approaches. Enter the AI auditorized systems approach to problem differently. They can scan code continuously, flagging math quirks, logic errors, and overlooked edge cases at machine speed. They don't replace human reviewers, but they add another set of eyes that never tires and can be run across every new commit. The $2 million lending bug illustrates the value of this model. What looked like a harmless rounding calculation would have been catastrophic in

practice. An AI system flagged it before attackers ever had the chance. Sherlock is a case study. Sherlock has been among the first firms to operationalize AI auditing. Its system produced a structured report on the lending bug, where the error appeared, how it could be exploited, and what the financial fallout might look like. Catching this issue showed that AI auditors are already changing outcomes, a Sherlock team member said. They're not theoretical anymore. They're surfacing mistakes that human audits might not catch. While Sherlock provided the example, the broader story is about the arrival of a new category. Just as professional auditing firms once became standard for defy projects, AI auditors are beginning to carve out their place in the process. Why the industry

should pay attention defy has already lost billions to bugs and logic fly. Each incident not only empties wallets but erodes trust in blockchain as a whole. The promise of AI auditors is not perfection, but additional defense, a way to surface errors at scale and reduce the odds that damaging vulnerabilities slip through. The combination of human review and AI oversight may soon become the new normal. The $2 million discovery serves as one of the first public proof points of that shift. Looking ahead the bug never touched Maynett, but it could mark an inflection point. Protocols, AI Auditors are already producing tangible results, preventing glosses, and

reshaping how teams think about pre-launch security. This moment may be remembered less for the bug itself than for what it represents. The emergence of AI auditors as a new category in Web3 Security. About Sherlock Sherlock asterisk describes itself as a full life cycle security partner for smart contracts, combining researchers, adversarial testing, AI systems, and financial coverage. The company supports protocols from build three. launch and ongoing updates, treating security as a continuous process rather than a single event. Last week, Sherlock added Sherlock Ait's suite, introducing automated code review designed to reinforce human audits with constant monitoring. Thank you for listening to this Hackernoon story,

read by artificial intelligence. Visit hackernoon.com to read, write, learn and publish.