Intelligent code auditing for solidity smart contracts

Abstract

Smart contract technology has witnessed rapid evolution and widespread adoption across diverse industries. However, with the immutable nature of blockchain-deployed contracts, vulnerabilities—especially those embedded in complex business logic—pose severe security risks. Traditional static analysis tools have struggled to accurately capture such vulnerabilities, prompting exploration into novel techniques that integrate large language models (LLMs), static analysis, and property-based testing. Firstly, we proposed a unified evaluation framework called LLM4Vuln, systematically decouples and assesses LLMs’ intrinsic vulnerability reasoning from external aids like knowledge enrichment and context retrieval. Evaluated on 294 code snippets spanning Solidity, Java, and C/C++ over 3,528 scenarios, LLM4Vuln not only elucidated the impacts of various enhancements but also uncovered 14 zero-day vulnerabilities in real-world projects, demonstrating both practical value and potential for significant security improvements. Secondly, building on these insights, we proposed GPTScan, the first tool to integrate GPT with static analysis for smart contract logic vulnerability detection. By decomposing each vulnerability into specific scenarios and properties, GPTScan employs GPT to identify critical code elements and then confirms these findings through static analysis. This hybrid approach achieves high precision on token contracts, maintains acceptable performance on large-scale projects, and delivers an overall recall above 70%, thereby effectively identifying vulnerabilities often overlooked by human auditors. Thirdly, to extend the scope of detectable vulnerabilities, we designed PropertyGPT, a framework leverages retrieval-augmented property generation. By harnessing LLMs’ in-context learning abilities, PropertyGPT generates compilable, context-appropriate, and verifiable properties for formal verification of smart contracts. Experimental results demonstrate an 80% recall relative to ground truth, with the framework successfully detecting multiple CVEs and uncovering several zero-day vulnerabilities, which have resulted in substantial bounty rewards. Fourthly, to address the detection of reentrancy vulnerabilities, we developed ReeSem. ReeSem combines static analysis with semantic understanding through LLMs. Its three-stage detection pipeline—filtering external calls, analyzing affected state variables, and semantically recognizing reentrancy guards—delivers an F1 score of 75.14%, outperforming state-of-the-art baselines significantly. ReeSem’s ability to generate consistent attack paths in real-world scenarios underscores its practical applicability and robustness. Fifthly, complementing the data-driven methods, ZepScope focuses on static analysis by mining constraints directly from official smart contract implementations, specifically, from those provided by OpenZeppelin. Through its MINER and CHECKER components, ZepScope extracts both explicit and implicit security checks and validates their enforcement in real-world contracts. This approach achieves an impressive accuracy of 89.67% across tens of thousands of contracts, offering critical insights into common code practices and potential security pitfalls. Collectively, these contributions, LLM4Vuln, GPTScan, PGPT, ReeSem, and ZepScope, form a comprehensive framework for enhancing vulnerability detection in smart contracts. By synergistically integrating large language models, static analysis, security constraints mining and property-based testing, this work advances the state-of-the-art in secure code auditing and provides valuable methodologies for developers, auditors, and the broader security community.