I use an LLM on every contract I review. I also assume it is lying to me until I prove otherwise.
That sounds contradictory, but it is the only way to get leverage out of AI without getting burned by it. An LLM will map a 2,000-line protocol faster than you can scroll it, and then it will confidently invent a CVE that does not exist, assign "Critical" to a non-issue, and miss the actual bug three functions down. The skill is not "use AI" or "do not use AI." The skill is running a workflow where every AI claim has to survive a verification step before it reaches your report.
Here is the exact loop I run, the prompts I use, and where I refuse to trust the model.
The Loop, Top to Bottom
Recon and triage with AI to build a mental map of the contract.
