Auditing with ChatGPT: Complementary But Incomplete

This report compares ChatGPT's pre-audit output with a CertiK audit of ZKasino smart contracts, showing that ChatGPT missed critical project-specific vulnerabilities (notably a transfer-revert refund exploit in the Bankroll contract enabling consistent attacker wins and fund drainage), failed to detect randomness/math issues in games (VideoPoker, Dice), and overlooked input validation and accounting inconsistencies (Plinko, Slots). The authors conclude that while ChatGPT surfaces common concerns, it often provides only surface-level analysis and should be supplemented by experienced human auditors.