Upload folder using huggingface_hub

README.md

@@ -38,9 +38,10 @@ uvicorn server.app:app --host 0.0.0.0 --port 8000
 ### 3. Run Baseline Agent (inference.py)
 ```bash
 # In a new terminal
+# In a new terminal
 API_BASE_URL=https://api.openai.com/v1 \
 MODEL_NAME=gpt-4o \
-HF_TOKEN=your_openai_key \
+OPENAI_API_KEY=your_openai_key \
 python inference.py
 ```
 

client.py

@@ -44,7 +44,7 @@ class AuditEnv(EnvClient[AuditAction, AuditObservation, AuditState]):
 
         return StepResult(
             observation=observation,
-            reward=payload.get("reward"),
+            reward=payload.get("reward", 0.0),
             done=payload.get("done", False),
         )
 

contracts/easy_reentrancy.sol

@@ -19,12 +19,11 @@ contract VulnerableBank {
         uint256 bal = balances[msg.sender];
         require(bal > 0, "No balance");
 
-        // BUG: External call to an address before updating state
-        // This is where the reentrancy attack occurs.
+        // Effects: Update state BEFORE external call
+        balances[msg.sender] = 0;
+
+        // Interactions: External call after state update
         (bool sent, ) = msg.sender.call{value: bal}("");
         require(sent, "Transfer failed");
-
-        // State update happens AFTER the external call
-        balances[msg.sender] = 0;
     }
 }

contracts/hard_complex.sol

@@ -15,33 +15,27 @@ contract ComplexAudit {
     uint256 public totalReward;
 
     constructor(address _m) {
+        require(_m != address(0), "Invalid manager address");
         manager = _m;
     }
 
     /**
      * @dev Simple push of data without gas checking.
-     */
     function pushData(string memory d) public {
+        require(bytes(d).length <= 1024, "Data too large");
         data[msg.sender] = d; 
     }
+    }
 
     /**
-     * @dev Vulnerable setter for manager role.
-     */
     function setManager(address nextManager) public {
-        // BUG: Missing onlyOwner/onlyManager check!
-        // Anyone can hijack the manager role.
+        require(msg.sender == manager, "Not authorized");
+        require(nextManager != address(0), "Invalid address");
         manager = nextManager;
     }
 
     /**
-     * @dev Dangerous functionality allowing delegation.
-     */
-    function execute(address target, bytes memory callData) public {
-        // BUG: Using delegatecall with user-supplied target and data.
-        // This allows an attacker to execute ANY command on the contract's behalf,
-        // effectively gaining full control over state and balance.
-        (bool success, ) = target.delegatecall(callData);
+    // Removed: delegatecall to arbitrary targets is inherently unsafe
         require(success, "Delegatecall failed");
     }
 

graders/grader_hard.py

@@ -12,8 +12,11 @@ def grade(action, ground_truth):
     score = 0.0
     feedback_parts = []
     
-    gt_vulns = ground_truth["vulnerabilities"]
-    agent_vulns = getattr(action, "vulnerabilities", [])
+    gt_vulns = ground_truth.get("vulnerabilities", [])
+    if isinstance(action, dict):
+        agent_vulns = action.get("vulnerabilities", [])
+    else:
+        agent_vulns = getattr(action, "vulnerabilities", [])
     
     matches = 0
     for gt in gt_vulns:

inference.py

@@ -1,3 +1,5 @@
+import os
+import json
 import requests
 from openai import OpenAI
 from dotenv import load_dotenv

server/Dockerfile

@@ -33,25 +33,25 @@ WORKDIR /app/env
 
 # Ensure uv is available (for local builds where base image lacks it)
 RUN if ! command -v uv >/dev/null 2>&1; then \
-        curl -LsSf https://astral.sh/uv/install.sh | sh && \
-        mv /root/.local/bin/uv /usr/local/bin/uv && \
-        mv /root/.local/bin/uvx /usr/local/bin/uvx; \
+    curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    mv /root/.local/bin/uv /usr/local/bin/uv && \
+    mv /root/.local/bin/uvx /usr/local/bin/uvx; \
     fi
-    
+
 # Install dependencies using uv sync
 # If uv.lock exists, use it; otherwise resolve on the fly
 RUN --mount=type=cache,target=/root/.cache/uv \
     if [ -f uv.lock ]; then \
-        uv sync --frozen --no-install-project --no-editable; \
+    uv sync --frozen --no-install-project --no-editable; \
     else \
-        uv sync --no-install-project --no-editable; \
+    uv sync --no-install-project --no-editable; \
     fi
 
 RUN --mount=type=cache,target=/root/.cache/uv \
     if [ -f uv.lock ]; then \
-        uv sync --frozen --no-editable; \
+    uv sync --frozen --no-editable; \
     else \
-        uv sync --no-editable; \
+    uv sync --no-editable; \
     fi
 
 # Final runtime stage
@@ -71,6 +71,11 @@ ENV PATH="/app/.venv/bin:$PATH"
 # Set PYTHONPATH so imports work correctly
 ENV PYTHONPATH="/app/env:$PYTHONPATH"
 
+# Install curl for health checks
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl && \
+    rm -rf /var/lib/apt/lists/*
+
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD curl -f http://localhost:8000/health || exit 1

server/__init__.py

@@ -1,8 +1,5 @@
 """Smart Contract Audit environment server components."""
 
-try:
-    from .audit_environment import AuditEnvironment
-except ImportError:
-    from audit_environment import AuditEnvironment
+from .audit_environment import AuditEnvironment
 
 __all__ = ["AuditEnvironment"]

tasks/task_hard.py

@@ -4,7 +4,7 @@ import os
 DIR = os.path.dirname(os.path.abspath(__file__))
 CONTRACT_PATH = os.path.join(DIR, "..", "contracts", "hard_complex.sol")
 
-with open(CONTRACT_PATH, "r") as f:
+with open(CONTRACT_PATH, "r", encoding="utf-8") as f:
     CONTRACT_CODE = f.read()
 
 HARD_TASK = {

tasks/task_medium.py

@@ -15,19 +15,19 @@ MEDIUM_TASK = {
         "vulnerabilities": [
             {
                 "type": "unchecked return",
-                "line": 21,
+                "line": 24,
                 "severity": "medium",
                 "description": "Return value of external call is not checked"
             },
             {
                 "type": "access control",
-                "line": 26,
+                "line": 30,
                 "severity": "critical",
                 "description": "Sensitive kill function lacks access control"
             },
             {
                 "type": "logic flaw",
-                "line": 34,
+                "line": 42,
                 "severity": "high",
                 "description": "Insecure reward mechanism allowing anyone to claim"
             }