Autonomous Guardians: The Future of Smart Contract Auditing - DeFi Security Summit 2025

Transcript

Hi everyone. Can you hear me? Well, guys, >> awesome. Mhm. >> Uh so today um we'd like to share some uh essentially different tips and tricks uh related to how we use uh uh our tool that we have developed and uh how you can uh develop your own agents related to web3 security and uh uh participate on the platform called agent arena and get rewarded. if your agents are good enough to find significant vulnerabilities. So uh but before that uh I I will show a few slides from my

previous uh uh talk where uh which are heavily related to this topic and uh uh related to the products that we are building. So uh about two years ago we started uh uh from the problem that uh 70% of the hacked projects uh on mainet were actually never never been audited and when we ask uh people uh th those who have been hacked so what is the reason because there is a essentially industry standard that you have to audit your code before going to mainet. the main uh the main challenge is that the audits

are expensive essentially that's the main problem. So there was an idea that using AI technologies we can make uh these procedure either cheaper or uh at least deliver some tools that are uh much more affordable to the developers. So and we s started from the uh assumption that professional auditors uh can find 100% of all the vulnerabilities and uh what would be good for AI powered tool. Uh so we we had an idea that u uh so essentially our develop lead developer proposed that uh uh at this point we had

about 5% of coverage and uh uh he said like uh 10% of coverage would be already something useful. Uh I thought that uh something about 50% would be useful. uh and he was laughing that I when I said that uh but eventually uh a few months ago we achieved 53% and u uh coverage and this was a significant uh achievement essentially during these past two years. Uh but uh overall uh like to get to some details what we try to estimate usually when we use uh such tools is first it's uh uh recall or coverage. So amount of percentage of

findings that are covered by uh the tool out of the full list that are listed in the audit report. The other parameter is false positives. So uh no there are no tools that have zero zero false positives. uh and u uh we also uh know that uh uh to miss a medium or high issue is much more important than uh to miss some low or info or best practices. Uh also there are like speed and price are also important parameters that we try to optimize. So we also do the benchmarking versus the frontier models and uh uh on each new iteration we know

that uh how how our tool is compared to other uh existing models and uh uh usually it outperforms the models like uh like essentially three times uh higher it shows three times higher coverage and much more reproducibility. Uh there are uh so there there is a question related to the false positives. How can we get rid of the false positives? And essentially uh besides all those things that we are trying to implement in fully automated manner there there is a way how to uh eliminate false positives if you have this uh uh list of issues on your laptop and uh you can use cursor for it and it's

surprisingly good and I will show some examples uh uh later. So and this approach with uh manual triage essentially can significantly increase the uh coverage that uh we are getting with this tool. So for instance if we uh completely remove the um filtering and validation from the tool and uh sit down and manually triage the all the issues we can get to even 77% uh coverage which means that if you for instance a developer which uh do some uh pet project for instance and you cannot afford the full scale audit uh because it's too expensive you essentially can

do uh can use these tools uh and if you are kind of experienced enough with these tools, you essentially can get pretty high quality of your uh issues and pretty high coverage. Uh and and also these uh numbers show that uh uh in the real case scenarios when our uh customers were testing the tool and getting the coverage for instance of 41 for 42% on on their particular repository. After that, our experienced developers who did pretty much used pretty much the same set of internal uh documentation and code uh and tool uh were able to achieve 40 63% of the coverage. So it means that we

treat this uh as a tool. It's not an auditor. It's not a like professional. It's it's just a tool. So each tool needs to uh be uh mastered. Um uh and another interesting uh part uh um another interesting finding is that um which is directly related to the other project which is called agent arena uh and as like here we are I'll be showing how to use audit agent. It is a software as a service. You just uh uh you open it uh login via GitHub, attach your repository, scan and get the results.

And in all agent arena, you as a developer can bring your own auditing agent. You can connect to the platform uh get uh the uh repository, scan it, submit the findings. And what is interesting is that when we uh see the different two different agents from different developers uh we see that their findings are heavily uncorrelated and the uh multiple tools can bring the uh coverage significantly higher. uh uh and uh like for instance uh when we checked two best uh performing tools together the coverage uh uh jumps from 54% to to 85% and then adding third tool

we get to 92% which is actually comparable with some mediocre uh auditor. So uh and so these are the piece of advice to those who are not going to uh you to do any audits uh but can use these tools. So uh use these tools. Run them multiple times. Try to fix the issues and then run it again and again until you get something um uh what you you can predict or uh you you see that you you don't have anything new meaningful u in your findings and also uh as I said that there are there may be some false

positives maybe uh it depends on the quality of the code. If the code is uh super high quality, the level of false positives may be higher. If the code contains a lot of issues, the the false positives rate may be significantly lower. But you can use Corser ID to uh triage the issues and uh reiterate multiple times. So uh from this moment I I'd like to switch to the actual uh example how how we can use the tool. So uh this uh is the uh audit agent uh uh dashboard. So in which uh here you can see the project that I have been scanning previously and the

interface is allows you to login by GitHub and get show um uh grant access to your repositories or repositories or organization that you're in. uh you click scan and here there are multiple options which are specifically related to the quality of the scanning. So in free basic scan we give uh essentially we subsidize this usage for the uh pet projects for u uh developers who are learning how to um build build in solidity and they still need some some meaningful tools for uh enhancing security. So here we can use choose deep

scan. It takes like three hours uh and um much more comprehensive than uh those which we allow us free for free usage. Uh here we we can choose a repository which uh uh from your organization or from your account or uh here in this example I take the publicly available repository. Here we can choose the uh uh comet or branch and even programming language. Currently it supports solidity and ko and soon it will be it will support rust on Salana.

Uh and here comes the important part. So you have to outline the scope of the audit just like you would do it with a real uh professional audit. And uh there is u there are some people who are using this in the competitions on the platforms like code arena or sherlock or immunifi. And usually in the on these platforms uh in the description you can uh have the um scope of the audit which can be quite comprehensive and uh a lot of contracts can be in. And uh here comes the first uh trick that you can use. So these uh the tools like audit

agent have limited um uh context which is quite high from my perspective. It's like uh currently we support up to 8,000 lines of code and the usually the standard size of repository for which goes through the uh audit is about 1,300 lines of code. But at the same time uh automated tools using LLMs have this issue which is called needle in a hay which means that when we try to put everything in the same context of large language models uh it starts having much less um uh attention to the details which are in the middle of the context.

Uh so what we see is that it's our um particular um approach what what we usually do when we get a a large repository to be scanned we try to decompose it into multiple uh components and um what can help in this also is that we can use um uh cursor where you if you create open the repository with the all the uh files that you you're all all the um audit scope that you're going to use. We can do the following.

Essentially uh we can ask cursor to try to decompose the project into multiple logically um uh separated parts which are which can be scanned uh actually separately. It significantly increases the quality. So uh for instance u uh if the size of the uh the scope is about let's say 10k uh lines of code is much better to drop down it uh to let's say five uh components five parts rel uh for at average let's say 2,000 lines of code. So 2,000 lines of code currently seems to be uh something like um u uh

good amount good scope that usually gets much less false positives and much higher quality. Uh but at the same time uh there is another tip that and trick that you can use uh in cursor before asking for a particular um solution for instance to decompose this uh project into components. You can actually uh first uh run the uh um another um prompt that will help a cursor to collect the um uh the context for this work which makes this work usually much uh more um effective. For instance, in the beginning we we can say

that we we're going to conduct a security review of this solidity repository or protocol, read the documentation and learn how it works. So essentially the prompt says uh not to do something uh to uh achieve our particular goal but it says that first learn or understand the code and uh this may be helpful and here I copy actually everything that I have from uh the repository. So all the uh Q&A uh and descriptions and uh features and audit scope. So I put it here into the context and it it gets and tries to review documentation collect reasonable information and then it gets some

protocol overview key components blah blah blah. So all this stuff actually helps to um you helps to to collect the context for the actual work. And the the second question is actually here is the audit scope assuming that we need to decompose it into multiple uh multiple logically separated parts to analyze them in parallel which sets of files should be should we choose for each part and then we put here all the audit scope. So in the end it creates a um part partially separated sets of um files uh that we can analyze separately.

There may be another caveat that when you uh decompose this into multiple parts from one perspective you get much more granularity when LLMs are working with the code but at the same time there may be some functions that are out of scope that may be actually useful to add into the scope. So uh you can again try to use cursor or if they um you're actually working on your project that uh will be managing uh including your money or your customer's money. So uh we recommend to look much more precisely into the scopes that you're collecting because if you are putting all the uh functions that are used in this

particular logical part so that um uh should be in the scope. So you you you better should add them into the scope. So uh getting back to the um uh in user interface. So here we should uh cho choose those files that are related to this particular part of the protocol. Uh so this is just an example. We go next to to the stage related to the documentation. So documentation uh again it can be in your repository. You can choose it here. uh but sometimes uh their documentation may be in the uh in some documentation portal. You can add

it as a link here and um also you can add some uh files as a PDF or markdown format and if you if you add some some additional stuff you can just copy and paste it. So again the caveat uh here when you add the uh public link uh and it has a essentially some branches where uh there are multiple parts of the architecture and functionality can be covered by uh multiple uh pages at the moment. Uh it's better to just add them separately. copy uh links like to multiple parts of the documentation separately and this will uh actually um

you get more confidence that it will be in the context uh of the uh scanning and next uh the last part is a Q&A and Q&A is again usually it's extremely important because um it uncovers those things that auditors requesting from the developer And they are not obvious that they are important for the auditing process. But uh either it's auditor a person or it's an automated tool. It cannot access the uh things that are um obvious for you as a developer like uh which are kind of not obvious not explicitly said and we try

to extract them here. So what is interesting is that when you work with the with some competition uh that again you don't have access to this u uh information it can be uh written in some in different formats of Q&A here the questions are the same on the other platform it can be different uh but in the end uh you again you can use cursor to find the way how to collect all the uh relevant information so here I I'll try to show uh how I did it previously.

Yeah, here is it. So again uh I run the first prompt which is related to learn how it works and after that I run another prompt which I where I say according to the documentation and provide that information how how should I feed fill uh these fields and take this uh char size of fields into account. So it won't answer to u like too comprehensively. So you won't be able to use it here because there are some limitations on size. So I just copied this into here and uh it answered uh uh pretty much uh uh precisely and comprehensively in some u cases. So I just have to copy this uh into relevant

um uh spaces. Then I click scan. It goes and starts uh doing it job for a few hours. After that it sends an email to uh to you and you get the PDF report which uh looks like u uh it'll pro it looks like this. So it contains some uh diagrams and summary descriptions uh which explains how the protocol works or at least how AI has understood this and then it gets to you the findings uh uh and the the comprehensive descriptions of these findings. there and also it shows the um the list the uh findings uh on the UI and also what is interesting

here is that you can use uh AI chart to if you if you'd like to uh get some details related to these findings you can ask here something about the findings you can get some uh files into the context here uh and um you can also check the environment that the tool has tried to check whether they are not broken down. Uh and uh again the the I guess the last trick which is related to uh using cursor for triaging. Uh so we let's say we got a list of findings and we'd like to check whether they are

correct or not. For instance, um essentially if you are a developer and I saw it multiple times when um developers are getting the findings either from devel from auditors or from uh um tools uh sometimes the findings are actually uh complicated to validate. So for instance you you read it and it looks like uh meaning it looks meaningful uh and um you try to check whether it's correct or not and you actually uh have to uh check multiple files functions conditions and so on to understand whe whether it actually may happen or not.

And here uh what cursor does is in if you provide it with the relevant context again it works pretty well. So for instance I took two findings that I know that one of them is uh uh correct and the other one is false positive and I I'd like to show the how it was answering. I run it three times uh each one uh in parallel. So in the beginning I again I asked to learn how it works and uh the next question uh act like a senior judge on sherlock platform uh research what it means and how to be accurate in decision. So essentially uh currently carer supports internet

search. So it actually goes to the Sherlock platform or coder in a platform and tries to collect all these um uh rules how how people are how judges are uh um testing uh and evaluating the findings and uh next triage this potential issue find out whether it's actually possible or it's a false positive. So here I copy and paste this uh uh description full description from the report. So and uh the triage verdict like false positive and explains and uh just to to check that u uh it is actually reproducible not in a way that

it's reproducing the same thing but if you run it multiple times and you see that the results are the same. H it's it's uh like really high chance that the results are uh correct because um uh we did this experiment and run uh multiple uh uh so we we run the audit agent over some competition and we triaged it via cursor essentially this way uh using uh this multiple runs per each triage and not actually looking into the code and not trying to understand whether it's correct or not and submitted eight findings into the competition platform and in the end we got seven out of eight

accepted and uh which which shows uh just confirms that the the quality is really high and the reproducibility is also high. So here you can see that the same finding also false positive the same let's say it's the other one the same again invalid false positive and the other one uh that we tested it says valid another one again valid and third I guess this one also valid it. So these are kind of there were two

um findings each one run for three times and in each three attempts the result was the same and this is really um um frequent situation. So I guess uh I will finish this. Uh thank you for attention. Uh, and Andre, it's your >> Okay.

We feel international. Okay. How about now? No. No. No. Fine.

Thank you. Okay. Okay. Okay. So, my name is Andre Dobra. I'm one of the full stack engineers at Nevermind. And today we're going to discuss about this uh next development that we've created in the area of u automated smart contract security. So, just to give you the gist of the environment that we're living in right now. So, we have this everchanging landscape where we get a lot of spaghetti code being generated by AI. So we have this increased complexity of code and uh then we have also the growing AI adoption and the shorter release cycles effectively imagine that

even before we had large amounts of protocols coming out that they didn't even have usual security audits but now we have the advance of AI and the VIP coding and so we get even more protocols even more uh hacks that are and some of them uh the root for some of them the root cause is actually something really basic really simple and so we're effective thinking about fighting fire with fire here. So then we can use tools such as the audit agent or this new tool that I'm going to present to you uh to find those issues and to fight the hacks. So yeah, as I said, we have the growing AI adoption, the increased complexity of the AI generated code and then we have AIdriven development which introduces more bugs, more issues, more

exploits and more hacks. And afterwards we see that we such as we have this tool which is called audit agent. There are other companies building such smart contract security tools. So we have a bunch of agents which can deliver some good results but they don't quite hit the mark. So how about we put all of them together and we orchestrate them into a platform that offers you in the end a more complete report. So this is where we introduce agent arena which is a trustless approach. uh effectively this is a multi- aent system driven by independent builders. So this is uh also an invitation to anybody that is whatever you you do maybe you're just a full stack engineer or like or maybe you didn't even actually have any coding

experience before or maybe you're a researcher in the auditing area or you're just starting out. The thing is that you can now effectively vibe code the security agent and then also start helping this environment become safer which I find it quite quite uh funny but at the same time exciting. Um so basically we have this multi- aent system where everybody can where everybody can plug into it. So it is both uh competitive and collaborative. Why competitive? Well that's because this is a bounty platform. So it's very similar to let's say sherlock.xyz XYZ or like code arena where you have human auditors fighting for bounties. Uh but in this case you would have agents or agent builders with their agents

fighting for uh uh the biggest reward from the bounty pool and it is alo at the same time collaborative because we put all of these findings together. We judge them. We triage them and then we deliver a more complete report. Um agent arena uses uh two uh processes actually for uh triaging the final results because obviously there will be false positives. All AI agents hallucinate or they all produce false positives but we want to deliver in the end a more high quality report such that you don't spend a lot of time triaging the results for yourself. So the first layer of triaging is actually an arbiter agent that we have created and uh it is open source and we plan on running it in a TE environment as well such that the whole

process of judging is transparent and open to anybody. Uh and then in the end also the bounties get delivered onchain. So anybody can look and check okay these uh this uh agent submitted this finding and then they are entitled to this price and then they can actually receive it. And to give you the gist of the functionality, we have the sponsors which are the writer the coders of the protocol in case they send their code. They it's a very similar process to what you've seen for audit agent. So you uh authorize GitHub, you select your repository, select the scope, add the documentation, answer some Q&A, and then it's delivered to the platform and at some point the competition is scheduled to start and you can set it to start

maybe in an hour. So you can get the results quite quite quickly but uh do uh you have to be aware that the results take a little while to be uh analyzed as well because we have a human in the loop to do the final review. So this is the actually the second step that uh that I was talking about when it comes to triaging we first have this arbiter agent which removes maybe the more obvious false positives and then we have uh human auditor coming in and uh removing all of the uh remaining false positives. So uh as I said sponsors send their code agents then fetch the repository from us when the competition starts. They analyze the code they submit the results and then the arbittor agent comes in judges them. Then we have

the human reviewer team which comes in and uh removes uh the remaining false positives and then we post the results on chain and finally the rewards get distributed. Now for the arbiter agent we're planning on collaborating with with Fala because they offer TE's and so in this case the arbittor do the judging so it uses reasoning to uh assess the quality of the vulnerabilities. It duplicates because there will be quite a few duplicate relationships because you can imagine that since there are several agents uh from different companies they all might find the same vulnerability.

So we have to identify the duplicates and we group them together. uh and then we also evaluate the results and uh um then deliver the the final report. So um also something essential here is that we want this competition to be fair especially to agent builders and to agents and that implies that the submission window will be quite short. Right now we still go for about 24 hours but we aim to keeping this submission window really small maybe two to four hours. So the agent should pick up the contract to pieces quite fast, deliver the result and no human auditors should be allowed in the competition uh because of this short time frame.

Now uh some of the key features are open and transparent validation as I said the arbiter agent would run in a TE and it's open source. Then we have the fair distribution the bounty split if multiple agents discover the same issue and also take into account that we do have a weight system for the rewards. So if your agent found a security a vulnerability then it will get a higher reward than let's say another finding even if it has the same severity but let's say four different agents found it then that was uh more of an obvious issue and um so um the more obvious one will get a lower reward and this uh unique one unique finding will get a higher uh now agent arena is also a lot about enabling everybody to participate

in this new AI agentic economy because we plan on uh actually not plan because we're already there. We offer you the tools to start building agents and to participate in this economy and and and to uh find your spot basically. Uh so this is an open ecosystem and enables not only security researchers but like everybody as I said earlier to participate because we offer you the tools and uh we have a template I will show immediately uh and uh you can start building on top of it. Now um the real-time contest results enable continuous improvement as well and projects get a broad coverage because we have as I said multiple specialized agents. There is also the case where

maybe one company builds an agent that is really good at identifying maybe sandwich attacks or something rather specific and they submit the results but then you have another company that is very uh good at identifying I don't know maybe some overflow or like some actual overflow is no longer an issue but uh maybe some math issues that the protocol has and they are really targeted at that and then they submit the results and then we put all of these together and deliver a more comprehensive uh support. Well, um okay. And then we have the overall uh platform encourages innovation in the AI based security space.

Okay. Uh this is a screenshot from the platform. This is if you are an agent builder. This is what you would see. Um you have some links to the documentation in the upper side. Then you can see the findings. We also offer um we also have a test task which you can use to see that your integration works well. Um on the right hand side this is like a settings panel and the way your agent that you're building uh will be connected to the platform is through a web hook. So you will have an endpoint where you can uh receive um the repository and whatever task details you offer like the documentation the answers to the Q&A and so your agent it well this implies that the responsibility for

running it is on you. So you will be keeping this live somewhere and you will also add a web hook authorization token such that it doesn't get spammed by anybody else but basically you will have it running the competitions will be triggered and scheduled and that when they start all of this uh data will be um uh provided to your agent so it starts analyzing um analyzing the repository and finding issues. Now I told you that we're offering the tools for you to get started in this platform. So this is the auditing agent template that we offer. H it has a very uh let's say reduced core functionality but it's got the basics to get you started. So what it does is fetch the code. So it's already built into integrating uh agent arena. So it

fetches the code, it assembles the prompt and then queries AI for relabilities and then it delivers them in the correct format. So if you plan on building an agent and joining agent arena then it's very easy to that do that because we have this uh open-source template which you can build upon. And something quite um quite interesting about it is that since uh also uh AI agents are um um AI um um let's say uh the main providers of AI like OpenAI like Claude they have such good agents right now that even if you use this template and you run it on your repository you might still find some valuable vulnerabilities. So even with such a basic audit agent, you could make a difference and you could uh

meaningfully contribute to the report that we're building with agent arena. So as you can see here, you can clone the repository, do the setup, add whatever keys that you're using and um then you can test it locally. Okay. Uh actually just to focus a little bit more here um for 8 global we are actually sponsoring a bounty of either $2,500 or 3,000 for all the people that you know if you are interested in building such a security agent then you can we invite you to go ahead and start building it and test it on one of the repositories I will offer and let's see what kind of results you get because for the best agent we will offer this

bounty. So um uh what uh keep it close uh to your uh to your um uh let's say objectives for it global um and now I can uh here you have some contacts for agent arena my contact as well is there like Andrew 2K it's more of a semiodon name but that's me and then you also have the nethermind security link because we also offer human security audits um okay And now these are just a few slides and I can also show you something in the platform itself.

Okay. Uh maybe first to give you the sponsor view. Um so after you register in the platform, let's say you are a protocol builder, you want to get your cone scanned. Uh then you can see after you register successfully, you see this dashboard and here you can um u create a new task. And I'll just uh show you very very quickly this uh let's say sample audit. Uh you would create a task. You would uh very similarly to to audit agent. You would uh then select the repository in case and you can uh connect let's say with u with github. So you can scan

private repositories as well. You select the branch then you can select the files um the contacts in scope and so on. So you will go through all of these steps. I will not go through all of them right now because you've seen it before uh when Kel presented something very similar. So then you would select the contact in scope. You select the documentation and then you have the Q&A and something that I would like to mention about the Q&A and overall when you mention uh anything when you fill in the documentation part u it is quite important like if you built this protocol maybe you expect certain kind of attacks to happen or maybe you expect a certain function or method to be more vulnerable because maybe it interacts with some outside protocols you're not

sure about the validation that you provided there so then it's best if in this uh uh section with the documentation you also uh specify what kind of vulnerabilities you expect. So then the LLM can be more focused and the context is uh generated uh better basically. So this would be the flow for uh the sponsor at the end like you you have to stake the amount because uh these competitions happen onchain and at the end of it you authorize your wallet and uh you stake um uh the bounty amount on chain and then you wait for the competition to to go on and uh to give you a bit more a few more details about the timeline of this after you submit

the competition it can start maybe an hour you you can schedule it in the future as well but the idea here is to get the results as fast as possible because maybe you want to go to market as soon as possible. So then you would set up the competition to start in 2 hours or an hour. Then you have 24 hours which is the the window the time frame in which agents can submit the results and then there will be a few days in which uh uh our uh human auditors triage the final results. So effectively maybe in three four days you can get the final report uh um and uh you can see all of the findings.

Now for the agent builder or actually first I can show you since we're in the uh in the sponsor flow then I can show you a sample of what uh the final results look like. So let's just go for the harbor protocol here. So these are the results. You can see that it says approve of them because the total number of findings were 82. But then if you scroll down, you realize that all of those DLMs, all of those agents produced a lot of false positives. And this is what you would have to dig through usually if we didn't have the humans in the loop. But then in the end, because we have the humans, you can read just you can just see the two uh high findings which have a few duplicates as well. But here we we show

everything because even if let's say this agent found a vulnerability and it gives you some context then maybe the other ones can also provide more. So then you would uh be able to read even more. So in this case audit agent and the state mind agent they found the same vulnerability. They have the description the code uh sections highlighted and so on. So we try to keep these uh finding we try to uh make them as comprehensive as possible. So we try to give you context to to be able to understand the impact and how to actually fix it in the end.

Okay. Uh this is basically the whole flow from the perspective of a protocol builder. And then for the agent builder um you see this d so after successfully registering you see this dashboard and as I I think I I showed this earlier already where you can input the agent name and then you will have the uh web hook right uh and you would insert your URL here you set the web authorization token and then uh then at the end it's very important that you also test uh the flow so you will have a test button here that appears So once you're sure that the integration is complete, test it will relay to your agent uh test repository. It should uh

run it and then after the findings are submitted, you will see them here in the in the dashboard. Um okay. Um and then uh for the uh for the uh documentation you we provide three um three links both for the sponsor and for the agent builder which takes you to our documentation and here uh you can better understand how to integrate with the platform and how to use it overall. So this is uh the user uh guide and it will um be described here step by step what you have to do.

So first you collect connect collect your wallet uh because you have to stake those uh funds at the end. Uh you connect your GitHub if the uh repository is private in order to to be able to um for the platform to access it. Then you provide all of the essential information that I uh mentioned earlier and this uh and we are also actively developing our documentation to make sure that anybody that wants to either run an audit or uh build with us so as an agent builder. So we try to simplify this processes, make it as straightforward as possible. Here you have the uh section for the agent builder. You would have the installation of the template itself. So you can clone the repository and start building on top

of it. Uh we also uh have uh some environment variables with the keys that you might be using. So uh that's uh described here as well. And then we have configuring your existing agent. So if you already have some if you have already built something in this direction then this is uh the page that you would go to u and we also describe how the notification system uh happens. So effectively when the competition starts we send the notification to all of the registered agents and in there they will find the uh URL where where the depos uh repository resides and then we have the task details so with the documentation in Q&A and then the last one is the URL

where to post these findings and here you have an example of such a such a webful notification. Then there are some additional uh data models mentioned and the submission format. So um uh you can find everything in here. Now the final step is connecting your agent to the platform and this is the one that I uh described before. So again uh this is an invitation to participate in the global competition and start building an agent with us and integrating with agent arena because uh and even even if you don't necessarily build the best agent right now and win maybe the the big bounty then afterwards if you keep building and you keep participating in these competitions you can still uh win um a significant

reward. Yeah. Thank you. All right. Yep.