Team self-disclosure of AI-generated Solidity

Methodology how we score #

**What this measures** This factor is a Boolean flag set to true if the protocol's team has publicly disclosed (via blog post, tweet, documentation, or conference presentation) that AI-generated Solidity or Vyper was used in security-critical code paths. Sources include curator review of public communications, documentation repositories, and recorded conference talks. The cadence is event-driven and is updated whenever a new public disclosure is identified.

**Why it matters** Team self-disclosure of AI-generated code in security-critical paths is a stronger signal than the co-authorship marker detection in RD-F-172, because it represents the team's own acknowledgment that AI tools were used beyond peripheral automation. Self-disclosure enables auditors and depositors to direct additional scrutiny to the AI-assisted sections and ask whether those sections received the same depth of independent review as hand-written code. In the dataset, protocols that disclosed AI assistance in post-mortems were also those where the AI-generated code's deviation from audited patterns was identified as a contributing factor to the exploit.

**Green / Yellow / Red** Green: no public disclosure of AI-generated code in security-critical paths; or team has disclosed AI-assisted documentation and test generation only, with explicit statement that production financial logic was not AI-generated. Yellow: team has disclosed AI-assisted code generation in non-critical paths (e.g., boilerplate, interface implementations) without clarity on whether critical paths were included. Red: team has publicly disclosed that AI-generated Solidity was used in security-critical code paths (core financial logic, access control, or fund-holding contracts).

**Common gray cases** Informal mentions of AI tool use (e.g., using Copilot for autocomplete while writing code) may be ambiguous about the extent of AI influence on the final production code; curator must assess whether the disclosure specifically references security-critical contract code.

**Notable historical examples** - **Moonwell** ($1.78M, 2026): Post-mortem and team communications referenced AI-generated code in the security-critical component that was exploited.

Measurement what to look for #

Determine whether the team has publicly disclosed (blog, tweet, docs) that AI-generated Solidity was used in security-critical paths.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 1 historical incident #