AWS Builder Center

Builder Center

Teaching Smart Contract Security One "Sensei Says" at a Time

Teaching Smart Contract Security One "Sensei Says" at a Time

AI agents that scans for Smart Contract Vulnerability.

My friend Chidi deployed his first smart contract to Ethereum mainnet last month. Three days later, someone drained 0.8 ETH from it. Not a fortune, but enough to hurt. The exploit? A classic reentrancy attack in his withdraw() function.
When he showed me the code afterward, the vulnerability was obvious. But before deployment? He'd never heard of reentrancy. He didn't know to check. His contract compiled, his tests passed, and he thought that meant it was safe.
This happens to new Solidity developers all the time. Security audits cost thousands of dollars. Automated scanners throw cryptic warnings. Stack Overflow answers assume you already know what CEI (Checks-Effects-Interactions) means. There's no middle ground—no patient teacher who explains why your code is dangerous and how to fix it.

What and Who

Contract Sensei is a Solidity security reviewer that explains vulnerabilities like a mentor, not a linter. You paste your smart contract code (up to 4,000 characters), and it:
  1. Scans for common vulnerabilities (reentrancy, access control, integer issues)
  2. Explains each finding in clear language with a real attack scenario
  3. Shows you exactly how to fix it with secure code examples
  4. Ends each finding with a "Sensei says:" wisdom quote that makes the lesson stick
I built it for junior Solidity developers in my AWS Student Builder Group—people writing their first DEX, their first NFT mint, their first DAO treasury. Not experienced auditors, but students who need to learn why security matters, not just what is wrong.
The name "Sensei" sets the tone: this isn't a lecturer or a critic. It's a patient teacher who's seen every mistake and wants you to learn from it without judgment.

How I Built It

The stack:
  • Frontend: Static HTML/CSS/JavaScript on S3, served through CloudFront
  • Backend: Python Lambda with Function URL
  • AI: Amazon Bedrock Converse API with Claude Haiku 4.5 (us.anthropic.claude-haiku-4-5-20251001-v1:0)
  • Infrastructure: AWS CDK (TypeScript) for deployment
The flow:
  1. User pastes Solidity code into the textarea
  2. Frontend sends code to Lambda Function URL
  3. Lambda calls Bedrock with a security-focused system prompt
  4. Claude analyzes the code and returns a structured review
  5. Frontend displays findings with severity badges and "Sensei says" quotes highlighted

The System Prompt

I wrote a detailed system prompt that shapes how Claude reviews contracts:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
system_prompt = """You are Contract Sensei, a patient and friendly Solidity security mentor.

Review the user's smart contract code for security vulnerabilities. For each issue found:

1. **Clear Explanation**: Explain what the issue is in simple terms
2. **Why This Is Dangerous**: Show a real attack scenario
3. **How to Fix It**: Provide corrected code with comments
4. **Sensei says**: End with a memorable one-line wisdom quote

Focus on these vulnerability classes:
- Reentrancy attacks
- Access control issues
- Integer overflow/underflow
- Unchecked external calls
- Front-running vulnerabilities
- Gas optimization issues (mention only if critical)

Use a warm, educational tone. Never condescending. Assume the developer is learning.
Use emojis occasionally (🦆, 🔴, ⚠️, ✅) to make it visual.
"""
The key is the structure: every finding follows the same four-part format. This consistency helps developers learn the pattern of security thinking.

The Hard Part: Balancing Detail and Readability

This was harder than I expected. My first version dumped everything Claude found into one long wall of text. Five reentrancy variants, three access control issues, two gas optimizations—it was overwhelming and hard to scan.
I fixed this by:
  1. Asking Claude to prioritize by severity (Critical > High > Medium > Low)
  2. Limiting the response to the top 3 most critical findings
  3. Using markdown headers and emoji badges to create visual hierarchy
  4. Keeping the "Sensei says" quotes short (under 15 words) so they punch
Now the output is scannable. You can skim the emoji badges, read the Sensei quotes, and dive into the fix code only when you're ready.

The Delightful Detail: Sensei Wisdom Quotes

The "Sensei says" quotes are not decoration—they're the glue that makes security lessons stick in your brain.
Here are real examples from my testing:
On reentrancy:
> "Sensei says: Attackers love this pattern because one transaction can steal everything—it's the gift that keeps on giving."
On access control:
> "Sensei says: Attackers love public functions with no guards because they're like unlocked doors—no key needed."
On integer underflow:
> "Sensei says: Attackers love when balances wrap around from 0 to millions—it's free money."
I tested this with 3 deliberately vulnerable contracts:
  1. A simple token transfer function (missing access control)
  2. A withdraw function with reentrancy vulnerability
  3. An admin function with no role check
Every review ended with at least one "Sensei says" quote that summarized the core lesson. When I showed these to developer friends, they remembered the quotes more than the technical explanations. "Unlocked doors" stuck. "Gift that keeps on giving" stuck.
Proof It Works
Live URL: https://ddixd5o5z4mtd.cloudfront.net 

Test It Yourself

Try this vulnerable withdraw() function:
1
2
3
function withdraw() public {
msg.sender.call{value: address(this).balance}("");
}
Contract Sensei will identify:
  • Critical: Reentrancy vulnerability (external call before state update)
  • Medium: Missing access control (anyone can call it)
  • Suggest fixes: Checks-Effects-Interactions pattern + access control modifiers
  • Provide working secure code examples

What I Measured

  • Latency: 2.5-3.5 seconds for most reviews (Haiku is fast, but security analysis needs more tokens)
  • Token usage: 1,200-1,700 tokens per review (higher than my other agents due to detailed explanations)
  • Cost per review: ~$0.0004 (still well under a cent per review)
  • Detection accuracy: Caught all 6 deliberate vulnerabilities I tested (reentrancy, access control, integer issues)

What I'd Do Next

Right now, it reviews code as-is. Next steps:
  1. Compare before/after — Let users paste "vulnerable" and "fixed" code side-by-side to see if they patched it correctly
  2. Severity filtering — Add a toggle to show only Critical/High findings for quick scans, or all findings for deep review
  3. Save & share — Generate a shareable report URL so developers can send the review to team members or mentors
  4. More vulnerability classes — Add front-running, delegatecall risks, signature replay, oracle manipulation
  5. Multi-contract analysis — Right now it's single-file only. Analyze full projects with imports and inheritance

What I Learned

This was my first time:
  • Writing a system prompt for code security analysis (very different from text explanation)
  • Using structured markdown output from Claude to create visual hierarchy
  • Balancing technical accuracy with beginner-friendly explanations
The biggest lesson: Security education needs emotion and personality. My first version was technically correct but boring. The Sensei persona, the emojis, the wisdom quotes—these aren't fluff. They make scary security concepts feel approachable.
When Chidi (the friend who got exploited) tested Contract Sensei with his original vulnerable code, the reentrancy explanation clicked immediately. The "gift that keeps on giving" quote made him laugh, but he remembered it. That's what good teaching does.

Try It

If you're deploying your first Solidity contract, run it through Contract Sensei first: https://ddixd5o5z4mtd.cloudfront.net 
It won't catch everything a $5,000 audit will catch. But it'll teach you the basics so you don't make the mistakes that cost my friend his ETH.
# agents
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article