Smart-contract audits are increasingly becoming a starting point rather than a final security verdict, according to GoPlus Security partner Adam, who argues that projects and platforms need continuous, AI-assisted monitoring as code, permissions and external dependencies change after launch.
Adam’s argument targets a long-standing weakness in crypto security: conventional audits generally assess a specific version of a contract at a particular time. A clean report may identify flaws in the code under review, but it cannot automatically account for later upgrades, changes to privileged permissions, newly discovered attack methods or vulnerabilities in connected services such as price oracles and cross-chain bridges.
Gate and GoPlus Security presented the case for a security model built around repeated checks before and after deployment. Their proposed workflow begins with token screening before launch, adds AI-supported contract analysis at launch, and continues with monitoring and recurring “health checks” once a protocol is live.
That approach would place greater scrutiny on a category of risk that code audits often cannot resolve on their own: how teams use the powers embedded in a contract. Gate’s security team said an audit can show that a project has the ability to mint tokens, impose a blacklist or alter trading rules, yet cannot determine whether those functions will later be used in a way that harms token holders.
Privileged access remains a major attack surface
Adam said many damaging incidents stem from operational failures rather than a programming mistake in the audited contract. Excessive owner privileges, stolen administrator keys, weak multisig controls, malicious governance proposals and governance attacks can all create paths to losses even where the underlying code passed an earlier review.
Multisig wallets are designed to require several approvals before an action is executed, reducing reliance on one private key. Their protection can weaken sharply when signers are poorly secured, too few signatures are required, or governance rules allow a hostile actor to alter the signer set.
The same issue extends beyond the contract itself. Modern DeFi applications often depend on libraries, wallets, bridges, oracles, front ends, cloud systems and software-release pipelines. A vulnerability or compromise in one shared component can affect multiple applications connected to it.
Gate’s security team said platforms should therefore maintain a live inventory of dependencies rather than treating a contract address as the full security perimeter. It also recommended separating operational duties, limiting the authority attached to a single key or employee, and using safety delays for sensitive actions such as upgrades or large withdrawals.
Security monitoring should also look beyond suspicious on-chain transfers, the team said. Changes in key control, unexpected contract upgrades, unusual cloud account logins, unplanned website deployments, version differences between released software and approved code, and abnormal withdrawal patterns can provide earlier warning of an attempted compromise.
AI changes the speed of both attack and defense
Adam said AI is moving contract analysis from manual research toward automated pipelines that can scan large numbers of contracts and revisit codebases that have remained untouched for years. That shift creates a race between defenders seeking to find weaknesses first and attackers using automation to search for exploitable patterns at scale.
Attackers currently retain a short-term advantage, Adam said, because automated tools reduce the skills and time needed to inspect contracts, while old deployments provide a large pool of potential targets. An attacker needs one viable exploit route; defenders must identify and close every material weakness in their systems.
Gate’s security team similarly said automation could shift malicious activity from reviewing dozens of contracts each week to scanning thousands. AI can also support more convincing phishing campaigns and deepfake-driven social engineering, raising the risk around stolen credentials, malicious transaction approvals and impersonated project representatives.
Adam cited internal AI-based rechecks of several 2026 incidents as examples of the speed he expects from automated auditing. He said the system detected an exploit path associated with ZetaChain, where losses were estimated at about $300,000, in five minutes. He also cited detection times of 402 seconds for WhiteEagle, 505 seconds for HumaFinance, 20 minutes for BoostHook, 12 minutes for Token of Power and 27 minutes for JoeAgentToken.
Token of Power, described by Adam as a seven-year-old contract, was associated with losses of roughly $1.5 million. The example illustrates why age alone should not be treated as evidence that deployed code remains secure. New analysis techniques, changing integrations and previously overlooked business-logic flaws can alter the risk profile of an old contract.
Audits need repeatable evidence and clear scope
Adam said useful audit reports should offer more than a broad pass-or-fail conclusion. He recommended a quantifiable security score for initial screening, key findings that help users and platforms make decisions, technical evidence that engineers can reproduce, and specific remediation steps followed by a rescan.
Gate’s security team added that a report should clearly state its goals, limitations and scope. Readers need to know whether an assessment covered external dependencies, privileged administration functions, front-end infrastructure or only the deployed smart contract.
The team said its AI audit process combines static analysis, business-scenario modeling and semantic validation. Static analysis examines code without running it, while scenario modeling tests how functions could interact under specific conditions, including malicious or unexpected ones. These approaches can reduce false positives, though automated findings still require review by experienced security engineers when a vulnerability could affect live funds.
Adam urged projects and platforms to recheck legacy contracts, schedule periodic scans for deployed code, combine AI audits with traditional human-led reviews and make tool-based security assessments part of token-listing procedures. He also pointed to efforts he said were intended to improve benchmarking for AI security tools, including OpenAI’s February 2026 launch of EVMbench, DeepScan V1 and an open-source AI auditing benchmark.
Users still need to review permissions
Continuous monitoring can reduce detection times, but it does not remove the need for users to assess basic token and wallet risks. Adam advised users to check token safety before trading, revoke unused approvals, avoid unlimited allowances where they are unnecessary, use strong passwords and two-factor authentication, and verify website domains before connecting a wallet.
He also recommended separating funds by purpose across different wallets and using hardware storage for larger balances. That structure can limit losses if a trading wallet approves a malicious transaction or interacts with a compromised application.
Gate’s security team said contract checks should focus on four practical areas: owner privileges, blacklist or trading restrictions, minting rights and transfer taxes. A token with high-risk flags in any of those categories warrants caution, particularly where the project team retains the ability to block transfers, create additional supply or impose changing transaction costs.
The emerging security model places less value on a historical audit badge and more on whether a protocol can demonstrate ongoing control of its code, dependencies and privileged access. For projects holding user funds, recurring checks, tightly managed permissions and rapid response procedures are becoming as relevant as the first audit completed before launch.
Strengthen your smart-contract defenses with ongoing AI-driven checks—learn the basics in this crypto safety standards guide.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
