Capturing 15 Top-Tier Zero-Day Vulnerabilities: A Consensus Protocol Debug Agent Framework Built by 0G Lab in Collaboration with Teams from NUS, PKU, and BUPT

marsbitPubblicato 2026-06-11Pubblicato ultima volta 2026-06-11

Introduzione

"Agents Capture 15 Critical Zero-Day Bugs: 0G Lab's Multi-Agent Framework Automates Debugging in Consensus Protocols" Distributed consensus protocols are notoriously difficult to debug due to complex, intertwined states. A novel framework, Agora, developed by 0G Labs with researchers from NUS, Peking University, and Beijing University of Posts and Telecommunications, tackles this by fusing deep domain expertise with a collaborative multi-agent LLM architecture. Agora moves beyond the limitations of single LLMs and traditional testing like fuzzing. It employs three specialized agents: an Orchestrator for global state, a Strategy agent for generating attack scenarios using distributed systems knowledge, and a TestGen agent that creates executable tests. A core innovation is its efficient "Succinct Memory & Communication" mechanism and a dynamic test harness. This allows the system to translate abstract hypotheses into concrete tests across languages like Go and Rust, run them, capture failures, and refine the approach in a closed loop—all with minimal token overhead. In rigorous evaluations on production-level protocols including Raft, EPaxos, and components from etcd and Sui, Agora discovered 15 previously unknown deep logic bugs (e.g., execution divergence, liveness violations). In stark contrast, powerful standalone LLMs like GPT-5.2 and Claude 4.5 found zero such bugs. Agora achieved this with a high precision of 73.9% and at an average cost of only about $40 per bug fou...

The "Holy Grail" of distributed systems—consensus protocols—has long been a "Bug Hell" for top-tier infrastructure engineers. Due to their extremely complex states and intertwined multi-node interactions, traditional testing and monolithic LLMs are almost powerless against hardcore Deep Bugs (deep logical vulnerabilities).

Recently, in a paper accepted at the upcoming ICML 2026, researchers from 0G Labs and top academic-industry teams including the National University of Singapore, Peking University, and Beijing University of Posts and Telecommunications proposed Agora—the first automated testing framework that deeply integrates domain knowledge with large language model multi-agent collaboration.

Through an innovative architecture that directly tackles the pain points of protocols, this framework has successfully captured 15 previously unknown protocol-level Deep Bugs in industrial and academic core protocols such as Raft, EPaxos, HotStuff, and BullShark! In stark contrast, top native large models like GPT-5.2 and Claude 4.5 all failed, scoring zero. As multi-agent systems and "Agentic Quality Control" become the hottest tracks in 2026, Agora delivers not just a paper, but a practical, industrial-grade solution.

Paper: "Agora: Toward Autonomous Bug Detection in Production-Level Consensus Protocols with LLM Agents"

1. Background: A Powerful Alliance between 0G and NUS, Merging Long-Term System Knowledge with the Cross-Generational Multi-Agent Paradigm

The evolution of distributed consensus protocols is both a history of genius innovation and a bloody chronicle of pitfalls encountered by countless top engineers. As Turing Award winner Lamport stated, ensuring the correctness of distributed protocol implementations is as challenging as navigating a constantly shaking maze blindfolded. On this "hellish" track, the market is quietly shifting: According to Gartner observations, enterprise consulting demand for multi-agent systems has surged over tenfold in just over a year, and the multi-agent platform market is entering a period of rapid expansion, nearly doubling annually—using "multi-agent collaboration" for the most hardcore low-level system verification is transforming from a frontier concept to an industry necessity.

Facing this hellish challenge, tech giants with halos were the first to embark on heavy-asset exploration. For example, industry leader Anthropic's recent internal Glasswing project within Claude Code attempted to use agents for low-level infrastructure testing, but its architecture still heavily relies on top-tier commercial large models, with vague project details and closed-door collaborations limited to a handful of large institutions and multinational corporations. More critically, such giant-led solutions may exhibit terrifying token consumption during operation. This high computational barrier and heavy-asset approach directly shut out startups and SMEs with limited budgets.

Are smaller companies and open-source communities doomed to be unable to afford top-tier automated vulnerability auditing tools?

Engineers from 0G Labs, collaborating with Xiang Liu from the National University of Singapore, Sa Song and Yong Sun from Beijing University of Posts and Telecommunications, and Ph.D. student Zhao-wei Zhang and researcher Ce-yao Zhang from Peking University's School of Intelligence, leveraged their profound knowledge in the agent domain to empower systems, launching a disruptive "David vs. Goliath" innovation. Their work has been accepted at the 2026 AI top conference ICML.

The academic world's "long-term accumulation of system knowledge" meets the industry's "pain points and keen insight." How can this ignite the next revolution in system security?

The 0G team has accumulated extremely rich production-level attack and defense experience in implementing blockchain consensus protocols; while the academic team has profound expertise in high-performance distributed systems, low-level concurrency control, and formal verification. They are keenly aware that traditional methods (like fuzzing) often struggle with state-space explosion when facing industrial-scale codebases. The researchers decided to infuse the "soul"—their long-accumulated knowledge of global invariant logical deduction in distributed systems—into the cutting-edge multi-agent collaboration paradigm and automated harness architecture, launching the open-source and accessible Agora framework.

Simultaneously, as a leader in modular AI infrastructure and high-performance decentralized data availability networks, the 0G team has accumulated extremely rich production-level attack/defense experience and real-world protocol defect samples in the industrial implementation of blockchain consensus protocols and high-concurrency BFT (Byzantine Fault Tolerance) architectures.

This cross-domain fusion fundamentally changes the game: it is neither blind brute-force testing nor large models "fumbling in the dark" without domain knowledge. Instead, through specialized agent roles, it transforms the decades of logical deduction intuition from seasoned system experts into strategic interaction and collaboration among agents, thereby acquiring the hardcore capability to outperform traditional testing tools.

Unlike Glasswing's heavy-asset approach, which voraciously consumes expensive top-tier tokens, Agora presents a highly accessible alternative for SMEs—it proves that even with a "slightly inferior" base model and higher cost-effectiveness, a cleverly designed domain-aware multi-agent collaborative architecture can still unearth hardcore Deep Bugs!

2. Pain Point: Monolithic LLMs Struggle to Break Through, Distributed Systems Hang Under the "Damocles' Sword" of Deep Logic

In today's world dominated by big data, blockchain, and distributed databases, consensus protocols (like Paxos, Raft, PBFT, etc.) form the foundational bedrock of the entire digital world. However, implementing consensus protocols is notoriously "hellishly difficult." Even industrial-grade benchmark projects like etcd, honed by countless top engineers worldwide over years of operation, still harbor Deep Bugs (deep logical vulnerabilities) that send chills down one's spine.

These vulnerabilities differ from ordinary low-level implementation bugs like memory leaks or integer overflows. They span multiple execution phases and depend on complex concurrent states. If maliciously triggered, they can not only cause core data corruption but also lead to catastrophic financial-level losses.

While Large Language Models (LLMs), hugely popular in recent years, have shown promise in general code analysis, they appear "intellectually challenged" when facing distributed consensus. They can at best find shallow defects in local code. When confronted with protocol-level logical vulnerabilities dependent on global state, monolithic LLMs often get stuck in the mud of local code, completely unable to perform global temporal reasoning.

3. The Breakthrough: Agora's Three-Agent Paradigm and Core Harness Architecture

To break this deadlock, Agora is the first to introduce the classic academic paradigm of Hypothesis-Driven Testing (HDT) into large model agent systems. To achieve efficient global reasoning, Agora completely abandons the traditional "lone wolf" mode, elegantly decoupling the workflow into three highly specialized agents with distinct roles:

Orchestrator Agent: Responsible for maintaining global state and performing "vulnerability exploitation" by extrapolating from known bugs.

Strategy Agent: Responsible for injecting distributed domain knowledge and generating highly aggressive anomalous scenarios tailored for CFT and BFT protocols.

TestGen Agent: The practical executor. The key that truly enables Agora to be operational and generate effective tests in a closed loop lies in its core automated testing architecture.

The architecture is illustrated in the following diagram:

In Agora's overall design, this "David vs. Goliath" accessible magic does not come out of thin air; it stems from the deep integration of its ingenious agent interaction mechanisms and the testing harness architecture.

The research team specially designed an extremely succinct and efficient communication and memory mechanism (Succinct Memory & Communication) within the system framework. While ensuring each agent focuses on its core tasks, it minimizes redundant context transmission overhead to the lowest level. Under this extreme communication constraint, the Orchestrator Agent (responsible for global coordination and state control), the Strategy Agent (responsible for generating distributed anomalous environments and scenarios), and the TestGen Agent (responsible for code testing and dynamic evaluation) are perfectly interwoven, collectively driving and fulfilling the Harness architecture:

Automated Closed-Loop Synergy: When the Strategy Agent deduces an abstract distributed attack scenario, relying on the highly decoupled interaction framework, the TestGen Agent can immediately launch the underlying test harness. This architecture not only possesses strong environmental adaptability, capable of spanning different programming language environments like Go and Rust to translate attack hypotheses into real, runnable unit tests, but also incorporates efficient reflection-loop technology.

Once a test throws an error during execution in the environment, the system precisely and real-time captures the call stack and execution logs, concisely feeding them back to the agents for targeted self-correction. This organic combination of "multi-agent minimal interaction + dynamic harness closed-loop" not only allows Agora to capture the most elusive deep logical bugs with extremely low token costs but also produces detailed analysis reports with very low false-positive rates.

The final operational overview is illustrated in the following diagram:

4. Results: Capturing 15 Top-Tier Zero-Day Deep Bugs, Baseline Large Models Score Zero

The evaluation results are astounding. The research team conducted a comprehensive assessment on four well-known consensus protocol libraries (including production-grade etcd and the underlying components of the emerging public chain core, Sui), comparing against top-tier models like GPT-5.2, Gemini 3.0 Pro Preview, Claude Sonnet 4.5, and Qwen3 Coder.

The outcome not only made 0G's own operational consensus systems more secure but also demonstrated overwhelming superiority:

15 New Logic Deep Bugs Uncovered: Agora successfully discovered 15 previously unknown protocol-level deep logical vulnerabilities. These span high-risk areas such as execution divergence, monotonicity violations, topology flaws, and signature vulnerabilities.

Native Large Models All Score Zero: In contrast, baseline models (even equipped with advanced ReAct dynamic toolchains) completely failed (0/15) against these deep logical vulnerabilities. They consumed massive amounts of tokens but could only find low-level code implementation bugs.

Extremely Low False-Positive Rate and High Cost-Effectiveness: Among all bug reports generated by Agora, genuine logical vulnerabilities accounted for a high 73.9% (false-positive rate only 26.1%). Even more impressive, it costs only about 5.32M tokens (approximately $40) on average to unearth one top-tier logical bug that would make seasoned architects lose their hair, demonstrating extremely high cost-effectiveness.

Results across multiple LLMs are shown below:

5. The Future: High Generalizability, Advancing into More Hardcore "Uncharted Territories"

Agora's success not only injects confidence into the security of distributed systems but also points the way for large model applications in vertical, industrial-grade scenarios.

Critically, Agora's architectural design demonstrates high generalizability and universality. The research team emphasizes that Agora can also be quickly reproduced and used by a broad user base in the form of plugins or skills. Our code (github.com/0gfoundation/agora) provides corresponding skills to aid reproduction. Furthermore, Agora's "Large Model + Multi-Agent Collaboration + Hypothesis-Driven" paradigm is not limited to consensus protocols. Due to the deep decoupling between its underlying workflow control and the upper-layer domain knowledge base and testing harness, the architecture means it can not only help numerous users quickly debug consensus protocols but can also be rapidly extended to other hardcore fields similarly plagued by "deep logical vulnerability hell" in a "plug-and-play" manner:

Database Concurrency Control: For testing complex transaction conflict defects in distributed databases under extreme isolation levels (like Serializable).

Operating System Kernels / Concurrent Systems: For deeply discovering hidden deadlocks and race conditions in multi-threaded infrastructure.

Web3 Smart Contract Auditing: For in-depth security boundary exploration of cross-chain protocols and DeFi logic involving complex economic models. The blockchain security market is projected to reach about $8.5 billion by 2026, and commercial products using "multi-agent security systems" for smart contract auditing, compressing audit cycles from weeks to hours, are already emerging. Market demand is exploding.

The era of AI-automated security for industrial-grade low-level infrastructure may have been officially inaugurated by Agora and its harness architecture.

We have reason to believe that Agora can help better test the capabilities of coding LLMs by discovering more deep bugs across various domains, and the deep bug use cases it finds can also help enhance coding LLMs' code comprehension abilities.

Agora can significantly improve the security of code repositories that form the foundation for financial secure transactions, such as consensus protocols, concurrency control, and smart contracts. Moreover, Agora can help more tech companies discover deeper logic bugs while consuming fewer tokens, saving funds and being more efficient!

More importantly, this precisely aligns with the two hottest current trends: First, multi-agent systems are transitioning from experimentation to production—Gartner predicts that by 2028, over 30% of enterprise software will have agentic AI built-in, and the multi-agent platform market size is expected to surge from the tens of billions to hundreds of billions of dollars within a few years. Second, "using agents to audit agents"—Agentic Quality Control—is becoming the industry standard for 2026.

Against the backdrop where the Veracode 2025 report indicates approximately 45% of AI-generated code contains security vulnerabilities and the agentic AI security market is growing at a ~42% CAGR, Agora enables tech companies to unearth deeper Logic Bugs with lower token costs, upgrading security auditing from a "human-powered task billed by the week" to an "automated capability delivered by the hour."

And as the landscape of this track becomes clearer, those who truly seize the early advantage are often not the loudest giants, but the team that first operationalizes the methodology and can consistently replicate it.

Domande pertinenti

QWhat is the core innovation of the Agora framework presented in the article?

AThe core innovation of the Agora framework is the first integration of deep domain knowledge with a large language model (LLM) multi-agent collaboration paradigm for autonomous bug detection in consensus protocols. It specifically uses a hypothesis-driven testing (HDT) approach with three specialized agents (Orchestrator, Strategy, and TestGen) coordinated within an automated test harness architecture to find deep logic bugs.

QHow does Agora's approach differ from traditional methods or using a single large language model (LLM) for bug detection in consensus protocols?

ATraditional methods like fuzzing struggle with state space explosion in industrial codebases. Single LLMs are limited to finding shallow, local implementation bugs and fail at global state and temporal reasoning required for protocol-level deep logic bugs. Agora overcomes this by decomposing the task into specialized agents that collaboratively perform global reasoning, hypothesis generation, and automated test execution with a reflection loop, enabling it to find complex, cross-stage vulnerabilities.

QWhat were the key experimental results of the Agora framework's evaluation on real consensus protocol codebases?

AIn evaluations on four major consensus protocol libraries (including etcd and Sui's components), Agora discovered 15 previously unknown protocol-level deep logic bugs across categories like execution divergence and monotonicity violations. In stark contrast, state-of-the-art single LLM baselines (GPT-5.2, Claude 4.5, etc.) equipped with advanced toolchains found zero such bugs (0/15). Agora achieved this with a high true positive rate (73.9%) and high cost-efficiency, averaging about 5.32M tokens (~$40) per deep bug found.

QWhat is the significance of Agora's design in terms of cost and accessibility compared to other industry approaches mentioned, like Anthropic's Glasswing project?

AAgora's design provides a cost-effective and accessible alternative to heavyweight, proprietary industry approaches. Unlike projects like Glasswing which rely on top-tier commercial models and incur high computational/token costs, Agora uses a streamlined multi-agent architecture with succinct communication. This allows it to achieve state-of-the-art bug detection using more cost-efficient base models, making advanced automated security auditing feasible for startups, SMEs, and open-source communities.

QBeyond consensus protocols, what other hardcore system domains does the article suggest the Agora framework's methodology could be applied to?

AThe article suggests that Agora's plug-and-play architecture, which decouples the core workflow from domain knowledge, can be generalized to other domains plagued by deep logic bugs. These include database concurrency control (e.g., testing transaction conflicts), operating system kernels/concurrent systems (e.g., for deadlocks and race conditions), and Web3 smart contract auditing (e.g., for complex cross-chain or DeFi protocol logic).

Letture associate

Raising Interest Rates Is Not a Tech Killer, EPS Is: A Strategy for Discarding the Weak and Retaining the Strong After the AI Theme's Sharp Decline

**Summary: Rising Interest Rates Are Not the Killer of Tech; EPS Is: The "Keep the Strong, Ditch the Weak" Strategy After the AI Theme Plunge** The author argues that the sharp sell-off in tech and AI-related stocks, triggered by a strong US jobs report that heightened Fed rate hike fears, represents a "pullback to pick up passengers" rather than a "car crash." The true end of a tech bull market is not determined by an extra 25 basis point hike, but by industry overcapacity and the disproval of earnings per share (EPS) expectations. Historical analysis shows that during past rate hike cycles, the Nasdaq-100 often outperformed, provided EPS growth remained strong. The current phase is seen as a shift from a "broad narrative-driven rally" to a "focused verification stage" for AI. The investment strategy should be to "keep the strong, ditch the weak." * **Retain exposure** to high-conviction AI infrastructure leaders with clear order visibility, stable margins, strong cash flow, and upward EPS revisions (e.g., AI servers, advanced packaging, optical modules, key cloud suppliers). * **Reduce exposure** to high-beta, narrative-driven stocks with unclear profit paths (e.g., some quantum computing, space, or speculative chip stocks), especially on rebounds. Valuation concerns should focus on whether earnings can catch up to high multiples, not on high P/E alone. Crowded positioning signals a concentration into quality assets, not necessarily a market top. The upcoming Q2 earnings season will be a key validation point. The core principle is to hold stocks with proven EPS, while using macro events (CPI data, central bank meetings) to manage timing and risk.

marsbit29 min fa

Raising Interest Rates Is Not a Tech Killer, EPS Is: A Strategy for Discarding the Weak and Retaining the Strong After the AI Theme's Sharp Decline

marsbit29 min fa

The Largest IPO in History Ignites Heated Debate: Is SpaceX Worth $1.77 Trillion?

SpaceX's potential IPO is priced at $135 per share, aiming to raise $75 billion and valuing the company at approximately $1.77 trillion, which would make it the largest IPO in history. This valuation has sparked intense debate among investors. Bullish analysts, including major underwriters Goldman Sachs and Morgan Stanley, argue the valuation is justified by SpaceX's long-term potential. They see it not just as a rocket company but as a future leader in space infrastructure, with key growth drivers being Starlink satellite internet, low-cost rocket launches, and future AI-related ventures. They project revenues reaching hundreds of billions to trillions of dollars by 2030-2040. ARK Invest's model suggests a 2030 enterprise value could reach $2.5 trillion. Bearish analysts from independent research firms like Morningstar, PitchBook, and New Constructs contend the IPO price is excessively high, already pricing in unrealistic future growth. Using DCF and sum-of-the-parts models, they estimate fair value between $780 billion and $1.7 trillion, significantly below the IPO target. They highlight risks such as the speculative nature of AI projections, over-dependence on Elon Musk, high growth expectations, and corporate governance concerns. Trefis set a target price of just $79 per share. While both sides acknowledge SpaceX's unique position in commercial space, the core disagreement centers on whether the $135 share price offers a reasonable margin of safety or is overly optimistic. Despite the valuation controversy, reported strong demand for the IPO indicates significant market interest.

marsbit2 h fa

The Largest IPO in History Ignites Heated Debate: Is SpaceX Worth $1.77 Trillion?

marsbit2 h fa

After the Passage of the GENIUS Act and the CLARITY Act, What Is the Correct Architecture for On-Chain Yield?

The article discusses the evolution of on-chain credit, distinguishing three markets: overcollateralized crypto lending, unsecured lending (largely unsuccessful), and asset-backed credit (ABC). ABC, backed by identifiable real-world collateral with legal recourse, is identified as the fastest-growing category and the only one credibly addressing adverse selection—the core problem in credit where the riskiest borrowers self-select. Current growth in on-chain Real World Assets (RWAs), particularly tokenized private credit funds (e.g., Maple Finance, Centrifuge), is substantial but often merely "wraps" existing fund structures, inheriting their risks rather than solving adverse selection at the protocol level. The regulatory landscape is a key driver, with the US GENIUS Act (prohibiting stablecoin issuers from paying yield) and the proposed CLARITY Act (closing loopholes on indirect yield) set to redefine permissible yield-bearing products. This makes vaults (like ERC-4626) the critical architecture—they become the primary compliant vehicle for delivering yield, functioning as issuance, disclosure, distribution, and recovery mechanisms. The author's thesis is that the correct post-GENIUS/CLARITY architecture involves building ABC solutions where credit assessment, structure, and recovery are encoded directly into the smart contract vault layer, moving beyond mere tokenized fund wrappers to solve adverse selection fundamentally and ensure regulatory compliance.

Foresight News2 h fa

After the Passage of the GENIUS Act and the CLARITY Act, What Is the Correct Architecture for On-Chain Yield?

Foresight News2 h fa

Trading

Spot
Futures

Articoli Popolari

Come comprare 0G

Benvenuto in HTX.com! Abbiamo reso l'acquisto di 0G (0G) semplice e conveniente. Segui la nostra guida passo passo per intraprendere il tuo viaggio nel mondo delle criptovalute.Step 1: Crea il tuo Account HTXUsa la tua email o numero di telefono per registrarti il tuo account gratuito su HTX. Vivi un'esperienza facile e sblocca tutte le funzionalità,Crea il mio accountStep 2: Vai in Acquista crypto e seleziona il tuo metodo di pagamentoCarta di credito/debito: utilizza la tua Visa o Mastercard per acquistare immediatamente 0G0G.Bilancio: Usa i fondi dal bilancio del tuo account HTX per fare trading senza problemi.Terze parti: abbiamo aggiunto metodi di pagamento molto utilizzati come Google Pay e Apple Pay per maggiore comodità.P2P: Fai trading direttamente con altri utenti HTX.Over-the-Counter (OTC): Offriamo servizi su misura e tassi di cambio competitivi per i trader.Step 3: Conserva 0G (0G)Dopo aver acquistato 0G (0G), conserva nel tuo account HTX. In alternativa, puoi inviare tramite trasferimento blockchain o scambiare per altre criptovalute.Step 4: Scambia 0G (0G)Scambia facilmente 0G (0G) nel mercato spot di HTX. Accedi al tuo account, seleziona la tua coppia di trading, esegui le tue operazioni e monitora in tempo reale. Offriamo un'esperienza user-friendly sia per chi ha appena iniziato che per i trader più esperti.

156 Totale visualizzazioniPubblicato il 2025.09.22Aggiornato il 2026.06.02

Come comprare 0G

Discussioni

Benvenuto nella Community HTX. Qui puoi rimanere informato sugli ultimi sviluppi della piattaforma e accedere ad approfondimenti esperti sul mercato. Le opinioni degli utenti sul prezzo di 0G 0G sono presentate come di seguito.

活动图片