WALSEC Documentation

What is WALSEC?

WALSEC is an autonomous multi-agent AI system that analyzes, exploits, and evaluates Sui Move smart contracts for security vulnerabilities. Built for the Sui Hackathon 2026, it combines three specialized AI agents with decentralized storage (Walrus) and on-chain proof (Sui blockchain) to deliver comprehensive, immutable audit results.

Supporting Infrastructure

Pipeline Configuration

// Timeout configuration
LLM_TIMEOUT_MS = 50_000        // Per-node LLM call timeout
PIPELINE_TIMEOUT_MS = 170_000  // Overall pipeline timeout
MAX_DURATION_MS = 180_000      // API route max duration
WALRUS_TIMEOUT_MS = 8_000      // Non-blocking Walrus fetch

POST /api/audit

Submit a smart contract for autonomous security audit.

// Request
{
  "code": "module vault::pool { ... }",
  "contractName": "VAULT_OVERFLOW"
}

// Response
{
  "success": true,
  "artifact": {
    "contractName": "VAULT_OVERFLOW",
    "vulnerabilities": [
      {
        "type": "Arithmetic Overflow",
        "severity": "Critical",
        "description": "...",
        "cwe": "CWE-190",
        "riskScore": 9.5,
        "affectedLines": [15, 22]
      }
    ],
    "agent_consensus": "...",
    "status": "completed",
    "txHash": "0x...",
    "walrusBlobId": "..."
  }
}

POST /api/walrus

Store audit artifact on Walrus decentralized storage.

// Request
{
  "artifact": { ... },
  "contractName": "VAULT_OVERFLOW"
}

// Response
{
  "success": true,
  "blobId": "walrus_blob_id...",
  "epoch": 428
}

Ask Walsec (Terminal Interface)

The "Ask Walsec" page (/config) is a retro-futuristic AI terminal. It requires a wallet connection to unlock. Your chat history and terminal session are permanently tied to your connected wallet address. Disconnecting your wallet will securely lock the terminal.

Generated code is elegantly presented in the dedicated AI Output Viewer on the right panel, complete with a language header and a one-click COPY button.

Terminal Commands

Move Contract: walsec_registry

WALSEC uses a Sui Move smart contract to store audit records on-chain. Each audit creates an immutable record tied to the operator's wallet.

// Event emitted on each audit
public struct AuditRecorded has copy, drop {
    operator: address,
    contract_name: String,
    severity: String,
    risk_score: u8,
    num_vulnerabilities: u64,
    timestamp_ms: u64,
    walrus_blob_id: String,
}

How It Works

1. User connects their Sui wallet to the application
2. Audit pipeline completes and generates the artifact
3. Artifact is stored on Walrus decentralized storage
4. A transaction is sent to the walsec_registry contract
5. The AuditRecorded event is emitted on-chain
6. History is loaded from on-chain events via sui_queryEvents

Contract Addresses

Package ID: 0x2d3f7e...  (testnet)
Module:     walsec_registry
Network:    Sui Testnet

VAULT_OVERFLOW

A liquidity pool contract with an arithmetic overflow vulnerability in the deposit function. The share calculation can overflow when large amounts are deposited, allowing an attacker to mint excessive shares.

ACCESS_CONTROL_BYPASS

An admin-controlled contract missing proper capability verification. The withdraw function lacks AdminCap checks, allowing any user to drain the contract's funds.

Auto-Fix Output

When a fix is applied, WALSEC generates complete, production-ready code with:

• Error code constants (EOverflow, EUnderflow, EInvalidAdminCap)
• Assertion guards (assert!(amount > 0, EZeroAmount))
• Capability verification (assert!(_cap.id == pool.admin_cap_id, EInvalidAdminCap))
• Safe arithmetic with overflow checks
• Proper resource handling and transfer semantics