About

I study informatics at TU Wien with a focus on cybersecurity. For my bachelor’s thesis I integrated two LLM-based smart-contract auditing tools into SmartBugs and benchmarked them on 143 labelled contracts — reentrancy, access control, bad randomness, the DASP Top 10 — against Slither, a classic static analyser.

Before any of that could run, I had to rebuild the benchmark corpus itself: 95 of 96 DeFi contracts would not compile as I found them, missing 245 dependencies between them. The result parser was losing 1368 of 1464 raw findings, all of them in the same tool; that is now zero. Every scanner runs containerised with networking switched off, and only the two that need an API get an explicit opt-in.

The most useful thing I found wasn’t a score. One scanner reported a clean contract and a crashed run in exactly the same way — no findings, no errors, nothing in the output to tell them apart. A tool that fails quietly is worse than one that fails loudly, so I made the pipeline say which of the two had happened.

Run the same scanner twice over the same 27 contracts at temperature 0, and about three quarters of the findings come back identical. For a security tool that is not a footnote.

Away from the screen: football now and then, Counter-Strike, and a guitar I picked up recently — which is why it will get its own counter on this site.