Development Fund Proposal
Author: HackenProof Team
Status: Draft
Created: 2026-03-23
Abstract
hBrain is a security-focused AI system designed to improve vulnerability detection in smart contracts and backend systems using real-world exploit data.
This proposal delivers reusable developer tooling (IDE plugin and GitHub integration) that enables early, context-aware risk detection directly within development workflows, improving security and reliability across the Canton ecosystem.
Specification
1. Objective
The problem addressed is the growing gap between development speed and security assurance.
AI-assisted development has increased delivery velocity, while security processes remain largely manual and difficult to scale. This creates a higher risk of undetected vulnerabilities, especially in complex contract logic and backend integrations.
The objective is to provide developers in the Canton ecosystem with tooling that:
- Detects vulnerabilities earlier in the development lifecycle
- Provides context-aware risk analysis
- Reduces noise compared to rule-based tools
- Improves overall security posture across applications
2. Implementation Mechanics
The solution is implemented as an AI-assisted security analysis system integrated into developer workflows.
Core Components
- AI inference engine trained on structured vulnerability data
- Code analysis pipeline for processing source code and pull requests
- Integration layer for IDE and GitHub workflows
Data Foundation
- 50,000+ historical vulnerability cases
- Includes:
- Severity decisions
- Exploit context
- Remediation outcomes
Workflow
- Developer submits code (IDE or GitHub PR)
- Code is analyzed by the AI system
- System outputs:
- Identified risks
- Severity assessment
- Highlighted vulnerable logic
- Suggested mitigations
Delivery
- VS Code plugin
- GitHub pull request integration
- API for CI/CD integration
The system is designed to complement audits and existing security processes.
3. Architectural Alignment
- Integrates with standard development workflows (IDE, GitHub, CI/CD)
- Supports continuous security validation during development
- Compatible with distributed application architectures
Alignment with Canton ecosystem priorities:
- Improves security and reliability of applications
- Provides shared tooling usable across multiple teams
- Enables earlier detection of issues in contract and backend logic
The system is modular and can be extended to support Canton-specific tooling and workflows.
4. Backward Compatibility
No backward compatibility impact.
Milestones and Deliverables
Milestone 1: Core AI Model
Estimated Delivery: Month 4
Focus:
Development of initial AI model for vulnerability detection
Deliverables / Value Metrics:
- Trained model on vulnerability dataset
- Baseline detection of common vulnerabilities
- Internal evaluation results
Milestone 2: Developer Tooling
Estimated Delivery: Month 8
Focus:
Integration into developer workflows
Deliverables / Value Metrics:
- VS Code plugin
- GitHub PR integration
- Inline risk detection and reporting
Milestone 3: Ecosystem Integration
Estimated Delivery: Month 12
Focus:
Usability and integration across teams
Deliverables / Value Metrics:
- Developer documentation
- API access
- CI/CD compatibility
Milestone 4: Deployment and Scaling
Estimated Delivery: Month 18
Focus:
Scalability and enterprise readiness
Deliverables / Value Metrics:
- Self-hosted deployment option
- Performance optimization
- Security hardening
Acceptance Criteria
The Tech & Ops Committee will evaluate completion based on:
- Deliverables completed as specified for each milestone
- Demonstrated functionality in real-world workflows
- Documentation and knowledge transfer provided
- Alignment with stated value metrics
Additional conditions:
- System demonstrates reduction in false positives compared to baseline tools
- Outputs are actionable and understandable for developers
- Tooling can be integrated into standard development workflows
Funding
Total Funding Request
2,000,000 CC
Payment Breakdown by Milestone
- Milestone 1 (Core AI Model): 25% upon committee acceptance
- Milestone 2 (Developer Tooling): 30% upon committee acceptance
- Milestone 3 (Ecosystem Integration): 20% upon committee acceptance
- Milestone 4 (Deployment and Scaling): 25% upon final acceptance
Volatility Stipulation
The project duration exceeds 6 months.
The grant is denominated in fixed Canton Coin and will require a re-evaluation at the 6-month mark.
Co-Marketing
Upon release, the team will collaborate with the Foundation on:
- Announcement coordination
- Technical blog or case study
- Developer-focused promotion
Motivation
This project improves the security baseline of applications within the Canton ecosystem.
By enabling earlier and more consistent vulnerability detection, it reduces the likelihood of critical failures and increases developer confidence.
The tooling is designed to be reusable across multiple teams, making it a shared infrastructure component rather than a single-project solution.
Rationale
This approach is based on the observation that traditional security tools rely heavily on static rules and often produce noisy results.
By leveraging real-world vulnerability data and integrating directly into developer workflows, the system provides more relevant and actionable insights.
Alternative approaches (manual audits, rule-based tools) are either not scalable or lack context awareness.
This solution is preferred because it:
- Scales with development workflows
- Provides contextual understanding of risks
- Can be reused across multiple projects
- Complements, rather than replaces, existing security practices
Pitch Deck: hBrain - Full Presentation (DocSend)
