Team self-disclosure of AI-generated Solidity
A tooling / compiler / ai factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor is a Boolean flag set to true if the protocol's team has publicly disclosed (via blog post, tweet, documentation, or conference presentation) that AI-generated Solidity or Vyper was used in security-critical code paths. Sources include curator review of public communications, documentation repositories, and recorded conference talks. The cadence is event-driven and is updated whenever a new public disclosure is identified.
Why it matters
Team self-disclosure of AI-generated code in security-critical paths is a stronger signal than the co-authorship marker detection in RD-F-172, because it represents the team's own acknowledgment that AI tools were used beyond peripheral automation. Self-disclosure enables auditors and depositors to direct additional scrutiny to the AI-assisted sections and ask whether those sections received the same depth of independent review as hand-written code. In the dataset, protocols that disclosed AI assistance in post-mortems were also those where the AI-generated code's deviation from audited patterns was identified as a contributing factor to the exploit.
Green / Yellow / Red
Green: no public disclosure of AI-generated code in security-critical paths; or team has disclosed AI-assisted documentation and test generation only, with explicit statement that production financial logic was not AI-generated. Yellow: team has disclosed AI-assisted code generation in non-critical paths (e.g., boilerplate, interface implementations) without clarity on whether critical paths were included. Red: team has publicly disclosed that AI-generated Solidity was used in security-critical code paths (core financial logic, access control, or fund-holding contracts).
Common gray cases
Informal mentions of AI tool use (e.g., using Copilot for autocomplete while writing code) may be ambiguous about the extent of AI influence on the final production code; curator must assess whether the disclosure specifically references security-critical contract code.
Notable historical examples
- Moonwell ($1.78M, 2026): Post-mortem and team communications referenced AI-generated code in the security-critical component that was exploited.
Measurement what to look for#
Determine whether the team has publicly disclosed (blog, tweet, docs) that AI-generated Solidity was used in security-critical paths.