Han Liu, Daoyuan Wu, Yi Sun, Shuai Wang · 5 authors
Access control (AC) vulnerabilities are among the most critical security threats to smart contracts. Despite extensive research, they remain widespread and damaging in the Ethereum ecosystem. To understand and advance the current state-of-the-art (SOTA) in AC vulnerability detection, we first curate a diverse dataset of 180 real-world AC vulnerabilities from CVE entries, DeFiHackLabs incidents, and Code4rena audit reports.Using this dataset, we conduct a systematic benchmark study along three dimensions. First, we develop a cause-based taxonomy and analyze the prevalence and evolution of AC vulnerabilities. Second, we evaluate six SOTA tools, including two from industry and four from academia, revealing low recall (3% to 8%) and significant blind spots. To understand these failures, we examine 1.2 million deployed contracts and uncover practical gaps in AC protection mechanisms overlooked by existing tools. Finally, we assess the potential of large language models (LLMs) for AC vulnerability detection and show that LLMs detect 53–75% of vulnerabilities, outperforming traditional tools but facing challenges such as hallucinations and scalability. Our findings highlight the need for hybrid approaches that combine static analysis with LLM-based semantic reasoning to address the complexity of modern AC vulnerabilities.
While Large Language Models (LLMs) have demonstrated remarkable progress in generating functionally correct Solidity code, they continue to face critical challenges in producing gas-efficient and secure code, which are critical requirements for real-world smart contract deployment. Although recent advances leverage Supervised Fine-Tuning (SFT) and Direct Preference Optimization (DPO) for code preference alignment, existing approaches treat functional correctness, gas optimization, and security as independent objectives, resulting in contracts that may achieve operational soundness but suffer from prohibitive execution costs or dangerous vulnerabilities. To address these limitations, we propose PrefGen, a novel framework that extends standard DPO beyond human preferences to incorporate quantifiable blockchain-specific metrics, enabling holistic multi-objective optimization specifically tailored for smart contract generation. Our framework introduces a comprehensive evaluation methodology with four complementary metrics: Pass@k (functional correctness), Compile@k (syntactic correctness), Gas@k (gas efficiency), and Secure@k (security assessment), providing rigorous multi-dimensional contract evaluation. Through extensive experimentation, we demonstrate that PrefGen significantly outperforms existing approaches across all critical dimensions, achieving 66.7% Pass@5, 58.9% Gas@5, and 62.5% Secure@5, while generating production-ready smart contracts that are functionally correct, cost-efficient, and secure.
As Ethereum smart contracts grow in complexity, upgrades are necessary but challenging due to their immutable nature. Proxy contracts enable upgrades without changing contract state, but current detection approaches often rely on source code or transaction history and fail to detect inactive proxies. Detecting these proxies is critical because dormant upgrade paths can be reactivated, introducing risks and potential attacks. We introduce PROXiFY, a lightweight bytecode-based tool that detects and classifies proxy contracts, including inactive ones, without requiring Ethereum nodes, source code, or customized EVMs. PROXiFY achieves a precision of 98.6% and recall of 97.1% on a high-confidence benchmark dataset. A demonstration of PROXiFY can be viewed at https://youtu.be/FuYs22_vosk.
Decentralized Finance (DeFi) staking is one of the most prominent applications within the DeFi ecosystem, where DeFi projects enable users to stake tokens on the platform and reward participants with additional tokens. However, logical defects in DeFi staking could enable attackers to claim unwarranted rewards by manipulating reward amounts, repeatedly claiming rewards, or engaging in other malicious actions. To mitigate these threats, we conducted the first study focused on defining and detecting logical defects in DeFi staking. Through the analysis of 64 security incidents and 144 audit reports, we identified six distinct types of logical defects, each accompanied by detailed descriptions and code examples. Building on this empirical research, we developed SSR (Safeguarding Staking Reward), a static analysis tool designed to detect logical defects in DeFi staking contracts. SSR utilizes a large language model (LLM) to extract fundamental information about staking logic and constructs a DeFi staking model. It then identifies logical defects by analyzing the model and the associated semantic features. We constructed a ground truth dataset based on known security incidents and audit reports to evaluate the effectiveness of SSR. The results indicate that SSR achieves an overall precision of 92.31%, a recall of 87.92%, and an F1-score of 88.85%. Additionally, to assess the prevalence of logical defects in real-world smart contracts, we compiled a large-scale dataset of 15,992 DeFi staking contracts. SSR detected that 3,557 (22.24%) of these contracts contained at least one logical defect.
Fuzzing is a widely used technique for detecting vulnerabilities in smart contracts, which generates transaction sequences to explore the execution paths of smart contracts. However, existing fuzzers are falling short in detecting sophisticated vulnerabilities that require specific attack transaction sequences with proper inputs to trigger, as they (i) prioritize code coverage over vulnerability discovery, wasting considerable effort on non-vulnerable code regions, and (ii) lack semantic understanding of stateful contracts, generating numerous invalid transaction sequences that cannot pass runtime execution. In this paper, we propose SmartFuzz, a novel collaborative reflective fuzzer for smart contract vulnerability detection. It employs large language model-driven agents as the fuzzing engine and continuously improves itself by learning and reflecting through interactions with the environment. Specifically, we first propose a new Continuous Reflection Process (CRP) for fuzzing smart contracts, which reforms the transaction sequence generation as a self-evolving process through continuous reflection on feedback from the runtime environment. Then, we present the Reactive Collaborative Chain (RCC) to orchestrate the fuzzing process into multiple sub-tasks based on the dependencies of transaction sequences. Furthermore, we design a multi-agent collaborative team, where each expert agent is guided by the RCC to jointly generate and refine transaction sequences from both global and local perspectives. We conduct extensive experiments to evaluate SmartFuzz's performance on real-world contracts and DApp projects. The results demonstrate that SmartFuzz outperforms existing state-of-the-art tools: (i) it detects 5.8\%-74.7\% more vulnerabilities within 30 minutes, and (ii) it reduces false negatives by up to 80\%.
Vulnerability attacks targeting smart contracts have caused significant losses of digital assets. Many approaches based on static analysis, fuzzing, and deep learning have been proposed for detecting contract vulnerabilities. However, most existing methods only support vulnerability detection within individual contracts. When contracts interact with each other through external calls, these methods fail to perform effective cross-contract security analysis, leading to false negatives and false positives. To address these limitations, we propose CrossMiner, a deep learning-based approach for vulnerability detection in contract interaction scenarios. CrossMiner enables comprehensive risk assessment for cross-contract security through trace analysis of function call chains. Specifically, CrossMiner first constructs a cross-contract dependency graph based on function call chains to effectively model inter-contract dependencies and network dynamics, and collect semantic information about contract interactions. Then, it employs a heterogeneous graph neural network with a two-level attention mechanism to finely extract and integrate complex features from the dependency graph, ultimately achieving precise risk assessment and vulnerability detection. We evaluate the effectiveness of CrossMiner on three types of smart contract vulnerabilities: reentrancy, timestamp dependency, and transaction state dependency. Experimental results demonstrate that CrossMiner achieves the best performance among all baseline methods, improving detection accuracy by 5.52%, 4.94%, and 5.60% for these vulnerabilities, and the F1 scores are improved by 5.44%, 5.02%, and 5.40%, respectively.
Smart Contract Reusable Components(SCRs) play a vital role in accelerating the development of business-specific contracts by promoting modularity and code reuse. However, the risks associated with SCR usage violations have become a growing concern. One particular type of SCR usage violation, known as a logic-level usage violation, is becoming especially harmful. This violation occurs when the SCR adheres to its specified usage rules but fails to align with the specific business logic of the current context, leading to significant vulnerabilities. Detecting such violations necessitates a deep semantic understanding of the contract's business logic, including the ability to extract implicit usage patterns and analyze fine-grained logical behaviors. To address these challenges, we propose SCRUTINEER, the first automated and practical system for detecting logic-level usage violations of SCRs. First, we design a composite feature extraction approach that produces three complementary feature representations, supporting subsequent analysis. We then introduce a Large Language Model-powered knowledge construction framework, which leverages comprehension-oriented prompts and domain-specific tools to extract logic-level usage and build the SCR knowledge base. Next, we develop a Retrieval-Augmented Generation-driven inspector, which combines a rapid retrieval strategy with both comprehensive and targeted analysis to identify potentially insecure logic-level usages. Finally, we implement a logic-level usage violation analysis engine that integrates a similarity-based checker and a snapshot-based inference conflict checker to enable accurate and robust detection. We evaluate SCRUTINEER from multiple perspectives on 3 ground-truth datasets. The results show that SCRUTINEER achieves a precision of 80.77%, a recall of 82.35%, and an F1-score of 81.55% in detecting logic-level usage violations of SCRs.
Airdrops are a widely used mechanism in Web3 ecosystems to incentivize early users by distributing governance tokens. However, these mechanisms are increasingly targeted by airdrop hunters—malicious actors who exploit token distribution systems through address farming, automated scripts, and behavioral camouflage. While prior work such as ARTEMIS leverages multimodal features and local transaction patterns to detect such behavior, it lacks a global understanding of wallet influence in the transaction graph. In this paper, we propose an enhanced detection framework that augments the ARTEMIS by incorporating PageRank-based global centrality as an additional structural feature. This allows the model to better distinguish superficially active wallets from those with broader influence in the network. We evaluate our method on real-world Non-Fungible Token (NFT) data from the Blur marketplace and achieve state-of-the-art performance. Furthermore, a feature substitution experiment reveals that simple degree-based features alone can achieve near-perfect performance, even outperforming PageRank, suggesting that the labels are strongly coupled with topological properties. These findings highlight both the effectiveness of structural augmentation and the potential risks of shortcut learning in graph-based detection systems.
Parsa Hedayatnia, Tina Tavakkoli, Hadi Amini, Mohammad Allahbakhsh · 5 authors
Smart contracts concentrate high value assets and complex logic in small, immutable programs, where even minor bugs can cause major losses. Existing taxonomies and tools remain fragmented, organized around symptoms such as reentrancy rather than structural causes. This paper introduces an attack-centric, program-structure taxonomy that unifies Solidity vulnerabilities into eight root-cause families covering control flow, external calls, state integrity, arithmetic safety, environmental dependencies, access control, input validation, and cross-domain protocol assumptions. Each family is illustrated through concise Solidity examples, exploit mechanics, and mitigations, and linked to the detection signals observable by static, dynamic, and learning-based tools. We further cross-map legacy datasets (SmartBugs, SolidiFI) to this taxonomy to reveal label drift and coverage gaps. The taxonomy provides a consistent vocabulary and practical checklist that enable more interpretable detection, reproducible audits, and structured security education for both researchers and practitioners.
Daojing He, Ding Ke, Sammy Chan, Kim‐Kwang Raymond Choo
Smart contracts have been the target of attackers (e.g., identifying and exploiting vulnerabilities). Existing countermeasures for detecting threats in smart contracts include symbolic execution, formal verification, and fuzzing, most of which only target specific known threats. However, such approaches may not be effective in detecting unknown/unseen threats (e.g., those without predefined vulnerability patterns). Building on the principles of smart contract threats and the immutability property, we propose a path profiling-based threat detection (PPTD) approach. To achieve accurate tracking of cyclic and acyclic paths, PPTD combines the profiling all paths (PAP) algorithm with the efficient path profiling (EPP) algorithm to record contract execution paths. This incurs lower gas overhead while effectively detecting and preventing threats. PPTD obtains legal paths and achieves data flow level detection through fuzzer, and automatically protects vulnerable smart contracts from threats, avoiding manual modification of vulnerable codes. Specifically, our approach is also designed to detect threats and prevent attacks after the contract is deployed, as demonstrated in our evaluations.
Eduardo Sardenberg Tavares, Antonio José G. Busson, Sérgio Colcher
Smart contracts are fundamental to blockchain ecosystems, but remain susceptible to security vulnerabilities that can lead to severe financial losses. Recent advances in agentic AI systems, powered by large language models (LLMs), enable autonomous code analysis and decision-making without explicit task-specific supervision. These systems leverage prompt engineering and zero-shot reasoning to detect vulnerabilities in smart contracts without prior fine-tuning. In this work, we evaluate the effectiveness of agentic LLM-based approaches in identifying vulnerabilities using prompt engineering and zero-shot reasoning across a curated dataset of Solidity smart contracts. Our findings highlight the limitations of current LLMs in automated vulnerability detection, providing insights into their practical applicability for securing decentralized applications. Our best-performing configuration, which integrates zero-shot reasoning with the Tree of Thoughts framework, achieved an F1-score of 73.66%.
Decentralized finance protocols are frequently exploited, creating a demand for fast and reliable repair of vulnerable smart contracts and validation that reflects runtime security. Large language models are an emerging source of patches, yet many evaluations rely on manual checks or self-assessment, which cannot confirm whether attacker profit is actually prevented. We introduce an executable benchmark that replays verified real-world exploits against patched Solidity contracts under a resilient protocol that permits alternate attack paths and controlled state variation. Our framework compiles candidate patches, deploys them on a forked chain, and tests whether the exploit still yields profit. The benchmark covers six test cases drawn from reproducible incidents and is released as open-source. Among the nine evaluated models, GPT-5, GPT-4.1, and Claude Opus 4.1 performed the best, mitigating four of six test cases. Microsoft Phi-4 was the most reliable open-source model, mitigating two of six exploits and producing compilable patches for the remaining cases. No model mitigated the H2O case once resilient checks were enabled, while a simpler access control flaw, BTNFT, was often repaired with minimal edits. Grounding validation in executable exploit replay provides a precise and scalable method to measure whether proposed repairs harden contracts at runtime.
Security vulnerabilities in smart contracts pose a serious threat to the blockchain ecosystem. Traditional detection methods heavily rely on expert-defined rules, leading to issues such as high false positives, false negatives, and poor scalability. Although recent deep learning-based approaches have shown promise, most focus on a single code modality, which limits their ability to capture the multi-dimensional characteristics of complex vulnerabilities. To address these limitations, this paper proposes MCLF, a novel smart contract vulnerability detection framework based on multimodal feature fusion and contrastive learning. The approach simultaneously extracts a Data Flow Graph and code semantic sequences from smart contracts to capture structural dependencies and contextual semantic information, respectively. A dual-branch Transformer architecture is designed to encode each type of feature, while contrastive learning is applied to optimize vector space alignment and enhance intra-class consistency. A masked language modeling task is further incorporated to improve semantic reasoning through multi-task joint training. Finally, transfer learning is employed to fine-tune the model for downstream vulnerability classification. Experimental results on a public benchmark dataset demonstrate that the proposed method achieves precision, recall, and F1score of 91.90%, 92.53% and 92.21%, respectively, significantly outperforming the most advanced vulnerability detection tools and validating the effectiveness of multimodal feature fusion and the contrastive learning mechanism.
B. Thanikaivel, Vishnupriyan. J, Dharma Sastha B., Naveen Akash. V
This paper presents a Smart Contract Based Integrity Verifier framework for web security in APIs. This framework utilizes blockchain technology in order to design a secure mechanism that makes use of cryptographic hashes to verify the credibility of API responses. Smart contracts ensure transparent and tamper-proof scoring while automating security enforcement The approach is relevant because it covers the weaknesses existing in the existing Oauth 2.0 APIs and provides a strong mechanism for data tampering detection and prevention. This is achieved through the implementation of the system on Python Framework and blockchain simulation, hence enabling users to interact with the system and send API responses validated for credibility. The framework ensures$\mathbf{9 8 \%}$verification accuracy rates as compared to the existing security mechanisms for API Credibility Verification. Future work is in integrating into various domains, such as healthcare, finance, supply chain, and IoT.
Alexy Bounsavath, Csaba Kiss, Tamás Savci, Gábor Hellner · 5 authors
The exponential growth of blockchain-based tokens has heightened the need for reliable methods to assess their longterm viability at deployment, a stage where historical market data is absent and risks such as scams and project failures are prevalent. This study introduces an explainable machine learning framework to predict token viability using static features available at launch, including smart contract properties (e.g., mintability, centralization), deployment details (e.g., network), and metadata (e.g., presence of an icon). We collected 100,000 ERC-20 tokens from Ethereum, Binance Smart Chain, and Polygon and analyzed their characteristics available at deployment and derived features. We labeled them as live or failed based on post-deployment scores derived from liquidity, transfer frequency, and holder distribution. Among the models evaluated, XGBoost with class-weight adjustment excelled, creating an enriched token set that contained, on average, 11 times more live tokens than the original dataset, surpassing other classification models in identifying viable tokens. SHAP analysis highlighted key predictors: tokens with icons, complex yet high-quality code, and deployment on Ethereum were more likely to succeed, while Polygon deployments correlated with higher risk. Though effective as an early filter, the framework's modest standalone precision underscores its role as part of a broader strategy integrating post-launch data. This approach advances early-stage token evaluation, enhancing investor decision-making and risk assessment in decentralized finance.
Vivi Andersson, Sofia Bobadilla, Harald Hobbelhagen, Martin Monperrus
Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. In auditing, proof-of-concept (PoC) exploits play a critical role by demonstrating to the stakeholders that the reported vulnerabilities are genuine, reproducible, and actionable. However, manually creating PoCs is time-consuming, error-prone, and often constrained by tight audit schedules. We introduce PoCo, an agentic framework that automatically generates executable PoC exploits from natural-language vulnerability descriptions written by auditors. PoCo autonomously generates PoC exploits in an agentic manner by interacting with a set of code-execution tools in a Reason–Act–Observe loop. It produces fully executable exploits compatible with the Foundry testing framework, ready for integration into audit reports and other security tools. We evaluate PoCo on a dataset of 23 real-world vulnerability reports. PoCo consistently outperforms the Zero-shot and Workflow baselines, generating well-formed and logically correct PoCs. Our results demonstrate that agentic frameworks can significantly reduce the effort required for high-quality PoCs in smart contract audits. Our contribution provides actionable knowledge for the smart contract security community.
Fabian Hensel, Avik Banerjee, Elmira Ebrahimi, Stefan Schulte
Solidity smart contracts are widely used to implement decentralized applications. However, their development remains challenging due to the language’s domain-specific complexity, the immutability of deployed contracts, which prevents post-deployment fixes, and the high risk of introducing security-critical vulnerabilities. While Large Language Models (LLMs) have advanced code generation across general domains, they often struggle to meet the structural and security-specific demands of smart contract development. Therefore, this paper presents a domain-adapted code completion model trained on 22,000 labeled code constructs extracted from Solidity contracts. The model is built on a transformer-based architecture and fine-tuned using Quantized Low-Rank Adaptation (QLoRA), a parameter-efficient method. The dataset is processed to highlight secure coding patterns and structural semantics, enabling the model to learn from both preceding and succeeding contexts. Evaluation using perplexity, the Bilingual Evaluation Understudy (BLEU) score, and the Metric for Evaluation of Translation with Explicit Ordering (METEOR) shows significant improvements with consistent gains across all three metrics compared to the base model. These results demonstrate that targeted adaptation of language models can significantly enhance coding support in Solidity smart contracts.
Muhammad Tahir, Adem Orsdemir, Fiza Siyal, Uzay Işın Alıcı · 6 authors
The rapid growth in blockchain technology adoption has highlighted the significance of security in Ethereum smart contracts. Due to its immutable nature, post-deployment rectification is not possible, and vulnerabilities such as reentrancy have led to substantial financial losses in recent years, making it a pressing research priority for its timely detection. Along with static and dynamic analysis tools, recent studies have shown promising results using Deep Learning (DL) and Machine Learning (ML) techniques for vulnerability detection using imagebased methods. Although these methods often suffer from high false positive rates and limited interpretability. To address these issues, we proposed an interpretable One-dimensional Convolutional Neural Network (1D CNN), a lightweight DL framework with integrated Gradients, an attribution for the Explainable AI (XAI) framework. This framework processes smart contract opcode in a series of sequences rendered as RGB-encoded strips, enabling effective feature extraction while preserving the contract semantics and execution order. Trained on a publicly available labeled comprehensive dataset named Messi-Q, which has already been used in prominent studies in the field. Approach achieves over 97% classification accuracy in detecting reentrancy vulnerability. More importantly, it provides fine-grained, opcode-level attributions offering a scalable and interpretable path forward for smart contract analysis.
Smart contract vulnerability detection has attracted increasing attention due to billions of economic losses caused by vulnerabilities. Existing smart contract vulnerability detection methods have high false negative and high false positive rates. To address these issues, we present ByteEye, a bytecode level smart contract vulnerability detection framework with Graph Neural Networks (GNNs). ByteEye first constructs an edge-enhanced Control Flow Graph (CFG) to maintain rich information from the low-level bytecode with low latency. ByteEye also designs and incorporates both general information and vulnerability-specific information into its detection method as bytecode level features. Furthermore, ByteEye flexibly supports machine/deep learning models, especially with graph neural networks, which can facilitate vulnerability detection precisely. The extensive experimental results highlight that ByteEye outperforms the state-of-the-art approaches on all three types of vulnerability detection. ByteEye can achieve an average of 35.29%, 43.95%, and 6.38% higher on F1 than the bytecode level best-performed baseline on reentrancy vulnerability, timestamp dependency vulnerability, and integer overflow/underflow vulnerability, respectively. Moreover, ByteEye can detect 361 new vulnerabilities in real-world smart contracts, which are reported for the first time. ByteEye enhances control flow information, designs general bytecode-level features with expert knowledge, and flexibly supports deep learning models, particularly GNNs, thus achieving high detection effectiveness.
Luca Olivieri, David Beste, Luca Negrini, Lea Schönherr · 6 authors
Hyperledger Fabric (HF) is currently the one that made blockchain and smart contracts accessible to industries, providing highly customizable solutions for many enterprise use cases. Despite this, programmers are often discouraged from implementing smart contracts due to the high learning curve and security risks of naive smart contract implementations. At the same time, the advent of Large Language Models (LLMs) for code generation led to new possible scenarios such as creating new smart contract applications starting from natural language, allowing to reduce costs and development times. This paper investigates the maturity of LLMs for the code generation of HF smart contracts. In particular, we (i) generate smart contracts written in Go for HF starting from natural language descriptions, (ii) select state-of-the-art static analyzers of Go program, and (iii) perform a quality and security assessment of the generated smart contracts. Our empirical results show current LLMs do not produce high-quality smart contracts, and a relevant effort to debug and patch contracts containing bugs and possible vulnerabilities.
Hadis Rezaei, Ahmed Afif Monrat, Karl Andersson, Francesco Palmieri
The deterministic nature of blockchain technology creates fundamental difficulties in producing secure random numbers within smart contracts, a limitation that exposes vulnerabilities in applications such as decentralized finance (DeFi) protocols and blockchain-based gaming platforms. From our observations, the current state-of-the-art detection tools suffer from inadequate precision while dealing with random number vulnerabilities. To address this problem, we propose TaintSentinel, a novel path-sensitive vulnerability detection system designed to analyze smart contracts at the execution path level and gradually analyze taint with domain-specific rules. This paper discusses a solution that incorporates a multifaceted approach, integrating rule-based taint analysis to track data flow, a dual-stream neural network to identify complex vulnerability signatures, and evidence-based parameter initialization to minimize false positives. The two-phase operation of the system involves the construction of semantic graphs and the analysis of taint propagation, followed by pattern recognition using PathGNN and global structural analysis via GlobalGCN. Our experiments on 4,844 contracts demonstrate the superior performance of TaintSentinel relative to existing tools, yielding an F1-score of 0.892, an AUC-ROC of 0.94, and a PRA accuracy of 97%.