Gno.land Unveils Dora: An Autonomous AI System for Deterministic Smart Contract Auditing

Dora: Proof Before Report

Developed by NewTendermint, the tool processes each candidate vulnerability through a seven-agent pipeline. The output is not a suspicion. It is a proven, patched exploit. For developers building on Gno.land, this shifts the security model from reactive bug reports to deterministic, pre-confirmed attack vectors.

Seven Agents, One Invariant

Dora's architecture is a sequential filter. A recon agent maps the codebase. A planner proposes candidate bugs. A deduplicator discards anything already catalogued. A verifier then writes and executes a live test against a running Gno.land node — the critical step that separates a hypothesis from a reproducible exploit. A reviewer adversarially checks that result. A fixer drafts a patch. A fix reviewer confirms the patch holds.

Only a finding that survives all seven stages reaches a human operator. The design eliminates the noise problem inherent in AI-assisted vulnerability scanning: cheap detection, expensive confirmation. On a platform where attacker-supplied code executes on-chain, a single panic can halt consensus. Nondeterminism can split validators. An overflow can move funds. Dora's pipeline is built to catch these state mutations before they propagate.

The tool remains internal. Gno.land has not completed a full sweep of the codebase, but targeted runs have produced reproducible findings with low noise. Broader coverage is planned.

Context: AI as First Auditor

The release reflects a broader industry shift. Bug bounty submissions across blockchain platforms are increasingly generated with AI assistance. Finding suspicious code is now inexpensive. Confirming that suspicion is a real, exploitable bug is not — and attackers have access to the same tooling as defenders.

Gno.land's architecture may suit this model. Smart contracts on the platform are written in Gno, an interpreted, fully deterministic variation of Go, and published as plain, human-readable source rather than bytecode. This makes the codebase legible to AI agents at every stage — from writing to auditing. The platform also recently released gnomcp, an open-source server that connects AI coding agents like Claude Code and Cursor directly to Gno.land, enabling agents to read, write, and deploy realms.

For smart contract developers, the takeaway is structural. Periodic audits and post-hoc bug bounties leave a window between vulnerability introduction and detection. Continuous, autonomous verification closes that window — if the verification pipeline itself is deterministic and adversarially tested. Dora's seven-stage design is one implementation of that principle. Whether it scales beyond targeted runs remains an open question.