AI for Web3 Security: Zero to Hero

What it is

The repo is a hands-on course whose deliverable is a Python package, lucid, that you build module-by-module into an AI bug-hunting harness. Beyond what the catalog covers, the repo ships as a runnable, incomplete work: Module 1 exists, but Module 2 is explicitly marked "coming next," so a reader expecting all four modules today will not find them.

What to do

Setup is a standard venv plus a gateway key. The base URL for Requesty is pre-filled in .env.example; you paste only the key:

python3 -m venv .venv
source .venv/bin/activate      # macOS / Linux; Windows: .venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env           # paste your Requesty key into OPENAI_API_KEY

Verify that key, base URL, and model all resolve before spending anything:

python -m lucid.check

Run against the bundled SecondSwap target, or point it at your own contracts — the harness is not locked to the course target:

python -m lucid.run                    # bundled SecondSwap
python -m lucid.run path/to/contracts  # a directory you choose

To drop the gateway and use OpenAI directly: delete the OPENAI_BASE_URL line from .env and set a real OpenAI model id (e.g. gpt-4o). The shipped MODEL (gpt-5.6-luna, in lucid/llm.py) is what produced the course's baseline runs; swapping the model does not require any other change.

Caveats

• Every lucid.run invocation makes a real, paid API call — the page flags this explicitly. Budget accordingly when iterating on a large contract set.
• Module 2 onward is not yet published; only Module 1 (single reasoning agent → structured findings, an honest baseline that "catches a few") is buildable now.
• One design note the summary omits: the pipeline runs no judge. Precision was already near 100% without one, so the judge role was deferred to Module 3 rather than used to filter Module 2's output — relevant if you were expecting a false-positive filter stage.