Monad open‑sources Ultrafuzz, unleashing advanced agentic smart‑contract threat hunting

Monad published the source code of Ultrafuzz, a smart contract auditing tool that coordinates hundreds of specialized artificial intelligence agents to detect vulnerabilities at runtime.

Version v0.1.0, available under the MIT license, was released after more than 20 runs on projects within the Monad ecosystem and incorporates support for Solidity and Vyper, new models and providers, improved monitoring tools and audit profiles with no prior configuration required.

One of the central findings from the tests was that property-guided direct vulnerability search outperformed traditional fuzzing based on executable tests. In the experiments, the NoFuzz variant detected 21 vulnerabilities per run compared to 2.6 for the original version, with lower token consumption. However, stateful fuzzing proved to remain crucial for identifying flaws that depend on transaction sequences, state changes or the passage of time.

The specification of properties and invariants also proved decisive: by removing them, the NoProperties variant found 22 vulnerabilities compared to 26 for NoFuzz. Monad also identified the diversification of exploration strategies as a key factor, and expanded from five initial strategies to more than 20 in the published version. Ultrafuzz v0.1.0 proposes combining direct property-guided research, selective stateful fuzzing and multiple specialized approaches in a single platform.

… Continue reading the full article at the original source below.