My Final Internship Project at Ether Authority: Smart Contract FixGPT

I’m happy to share that I have completed my internship at Ether Authority, where I developed Smart Contract FixGPT as my final internship project.

During this project, I worked on building an AI-assisted platform that helps developers identify Solidity smart contract vulnerabilities, generate potential fixes, and verify whether those fixes address the targeted security issues.

Smart contract security is an important part of Web3 development because vulnerabilities can lead to financial losses, unexpected contract behavior, and other security risks. My goal with Smart Contract FixGPT was to create a practical workflow that combines static analysis, AI-assisted remediation, compiler checks, and automated security testing.

What Is Smart Contract FixGPT?

Smart Contract FixGPT is a web application designed to help developers analyze Solidity contracts and investigate potential security vulnerabilities.

Instead of stopping after detecting an issue, the application attempts to guide the developer through remediation and verification.

The workflow includes:

1. Analyze the Solidity source code using Slither.
2. Identify reported security findings and explain them in a more readable format.
3. Use Gemini AI to generate suggested remediation code.
4. Prepare candidate code and a diff showing the proposed changes.
5. Compile the candidate code using a compatible Solidity compiler.
6. Run Slither analysis again to check whether the targeted finding remains.
7. Run Foundry-based security tests for supported verification scenarios.
8. Generate a report containing findings, suggested resolutions, project score, and PASS/FAIL status.

The verification process is designed to provide more evidence than AI-generated code alone. A successful check for a targeted finding does not prove that the entire contract is free of vulnerabilities.

Key Features

1. Solidity Vulnerability Detection

Smart Contract FixGPT uses Slither for static analysis of Solidity source code.

The application organizes findings into readable titles, descriptions, and recommended resolutions instead of presenting only raw detector identifiers.

The vulnerability categories handled or surfaced in the project include:

• Reentrancy (reentrancy-eth) — examines a class of issues where an external interaction can allow unexpected re-entry into a contract.
• tx.origin misuse (tx-origin) — flags risky authorization patterns that rely on tx.origin.
• Low-level calls (low-level-calls) — highlights uses of low-level call mechanisms that may require careful security review.
• Unchecked ERC-20 transfers (unchecked-transfer) — identifies token-transfer patterns where return values may not be checked appropriately.

These are examples of the detector categories handled by the application, not a claim that every instance is automatically exploitable or that every vulnerability category is fully verified.

2. AI-Assisted Remediation with Gemini

After identifying a finding, the application uses Gemini AI to propose a potential fix.

The remediation workflow generates candidate Solidity code and a diff so that developers can inspect the proposed changes rather than blindly replacing their original contract.

The AI-generated solution is a suggestion that still requires technical review and verification.

3. Dynamic Solidity Compiler Selection

Solidity projects can specify different compiler requirements through their pragma statements. Using an incompatible compiler can prevent a contract from compiling correctly.

To address this issue, I implemented a dynamic compiler manager in analyzer/compiler_manager.py.

It parses supported Solidity pragma formats, including exact versions, caret constraints, and version ranges, to select a compatible compiler version. The workflow can also install a required compiler version when it is missing from the environment.

This helps make the analysis and verification process more adaptable to contracts that use different Solidity compiler versions.

4. Compilation and Security Re-Analysis

After a candidate fix is generated, the application attempts to compile it and then runs static analysis again.

The objective is to check whether the targeted vulnerability is still reported. The report can also show other findings that remain after the proposed change.

For example, removing one targeted finding does not mean that all other findings have disappeared. In testing, a verification flow was able to remove a targeted reentrancy-eth finding while still reporting low-level-calls.

5. Foundry-Based Security Verification

For supported scenarios, Smart Contract FixGPT uses Foundry tests to check contract behavior.

The verification flows I tested included:

A reentrancy-related security test for a sample contract.

A tx.origin authorization test designed to ensure that the targeted unsafe pattern was blocked.

Compilation checks and post-remediation Slither analysis.

These checks improve confidence in a proposed fix, but they do not replace a comprehensive security audit or a full suite of contract-specific tests.

6. Reports, Resolutions, and Project Status

The application generates reports in JSON and Markdown formats. The report workflow includes:

Detected findings and readable vulnerability descriptions.

Suggested resolutions.

Verification information where available.

A project score.

A PASS/FAIL status.

The project score is an application-specific indicator, not an industry-standard audit rating. PASS/FAIL should also be interpreted according to the checks that were actually executed.

Technology Stack

The project combines blockchain security tools, a Python backend, an AI integration, and a web frontend.

Technology

Purpose

Solidity

Smart contract source code being analyzed

Slither

Static analysis and vulnerability detection

Foundry

Compilation, execution, and security testing

Python

Backend analysis and verification logic

FastAPI

Backend API

React

Frontend user interface

Vite

Frontend development and build tooling

Gemini AI

AI-assisted vulnerability remediation

solc / solc-select

Solidity compiler execution and compiler-version management

Git and GitHub

Version control and project repository

Vercel

Frontend deployment

Render

Backend deployment

Solidity Compiler Versions Tested

I tested the dynamic compiler workflow with the following Solidity compiler versions:

0.8.24

0.8.28

0.8.33

0.8.37

The compiler-manager tests confirmed exact-version selection for 0.8.28 and compatible selection behavior for tested caret and version-range constraints.

These results refer to the tested compiler-management workflow. They should not be interpreted as proof that every contract, dependency, pragma format, or Solidity version is supported.

Testing and Validation

During development, I ran focused tests to validate important parts of the workflow.

Compiler manager tests: passed for the tested compiler-selection scenarios.

tx.origin verification tests: passed for the targeted test case.

Reentrancy verification: the Foundry-based test passed for the sample contract.

Security verification flow: compilation succeeded, and the workflow checked whether the targeted reentrancy finding remained.

Post-remediation analysis: the application was able to report findings that remained after a targeted finding was removed.

These tests helped validate the individual workflows without claiming that the platform detects or fixes every possible smart contract vulnerability.

Deployment and Source Code

Smart Contract FixGPT is available as a deployed web application, and its source code is available on GitHub.

Live application: https://smart-contract-fixgpt-eight.vercel.app/

GitHub repository: https://github.com/PranshuMishra2004/smart-contract-fixgpt

What I Learned

Building Smart Contract FixGPT gave me practical experience in connecting AI-assisted development with established smart contract security tools.

Some of the most valuable areas of learning included Solidity static analysis, compiler compatibility, FastAPI backend development, React frontend integration, Foundry-based testing, deployment, and the importance of verifying AI-generated code.

One key lesson was that generating a fix is only one step. A useful security workflow should also compile the proposed code, re-run relevant checks, test expected behavior, and clearly report any remaining issues.

Final Thoughts

Completing my internship at Ether Authority and developing Smart Contract FixGPT as my final project has been a valuable learning experience.

The project represents my practical work in blockchain development and smart contract security, along with my exploration of how AI can support a structured remediation and verification workflow.

Thank you to Ether Authority for the internship opportunity and for the experience I gained while working on this project.

Project links:

Live application: https://smart-contract-fixgpt-eight.vercel.app/

GitHub: https://github.com/PranshuMishra2004/smart-contract-fixgpt

Solidity #SmartContractSecurity #Blockchain #Web3 #Foundry #Slither #Python #FastAPI #React #ArtificialIntelligence #Internship