I think expanding the security program is a positive step for Arbitrum, especially because security is very important for blockchain projects. I also think that combining AI security tools, human audits, and a Bug Bounty program can provide better overall protection for the ecosystem.
At the same time, I believe it is important to maintain transparency about how the budget is being used and to provide clear results from the program.
Hello Arbitrum Security Program team,
Your approved program is trialing five AI screening providers before full audits. Is there a current, unassigned need for an independent evaluation of those outputs against human-audit findings, remediation evidence and false-positive cost? I am asking about the evaluation work, not seeking to represent another scanner as an approved provider or duplicate an existing assignment.
If you are commissioning this work, who has authority to approve a paid pilot, what scope and evaluation data are available, and is any budget specifically reserved for it? I would propose a small, fixed-scope pilot only after a source commit, ground-truth criteria, data access, acceptance tests, and vendor eligibility are agreed. I can provide a reproducible scoring method and an auditable evidence trail; I would first discuss the scope your team actually needs.
Because compensation for this engagement must be entirely cryptocurrency, can the agreement state a fixed USDC amount, the Arbitrum network, the obligated payer, objective acceptance, and a payment deadline? A receiving address can be provided when payment becomes due. Please also confirm any KYC/KYB, residence and legal-entity requirements. I would not begin substantive work before the signed terms and funding route are in place.
If this evaluation is already assigned or unfunded, please say so; I do not want to duplicate existing work.
Hi @Hank, thank you for your comment. The audit committee reviews the AI audit output and is responsible for determining whether human audits are required. Accordingly, additional evaluation won’t be required.
Picking up the transparency points raised here by @MconnectDAO and @BenValdman, and earlier by JulianCross and GozmanGonzalez.
I’m Bilel from Trustblock. We keep a public record of published smart contract audits: which firm reviewed which code, when, what it found, and the status of each finding. It covers over 10,000+ reports from 50+ firms and shows on contract pages of 26 explorers, Etherscan and Blockscout included.
Each ASP audit will already appear there once its report is public. What’s missing for delegates is the program view. If the Foundation shares which audits the ASP funded, we’ll put up a public page for the program: reports delivered, findings by severity, and how many were fixed, acknowledged or left open, on one scale across auditors, updated as reports come out and in time for each quarterly transparency report. Every figure links to the reports behind it, and the same data is open through our API.