VulnPatch: Multi-Agent Automated Smart Contract Vulnerability Detection, Explanation, and Mitigation Framework

Abstract

With the advent of Web3, there has been an unprecedented number of smart contracts being executed on decentralized networks like Bitcoin and Ethereum. While recent studies offer vulnerability detection frameworks and mitigation recommendations, little research addresses the pipeline from vulnerability detection to meaningful patch generation. We introduce VulnPatch, a generalized smart contract auditing and patching framework that employs multiple, fine-tuned LLM agents with distinct roles: detecting vulnerable functions, explaining their causes, and generating patched code. We have demonstrated empirically that having these sub-tasks delegated to different agents significantly improves performance across these sub-tasks rather than having one single agent that will handle all the tasks together. VulnPatch operates in three stages: first, fine-tuning the LLM on vulnerable and safe Solidity contracts; second, pinpointing vulnerability causes; and third, producing a report detailing vulnerable code and corresponding patches. Compared to state-of-the-art LLMs, VulnPatch achieves $\mathbf{9 3. 3 \%}$ accuracy and F1 score, generating reports for 84.44% of vulnerabilities, with explanations and patches showing $90 \%$ sound reasoning and $84 \%$ patch validity.