Pith. sign in

REVIEW 3 major objections 5 minor 59 references

Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization

T0 review · 3 major / 5 minor · reviewed 2026-07-13 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Shared DeFi economic mechanisms, stored as a knowledge graph, let an agentic loop catch every high-severity smart-contract bug in a hard post-cutoff test set.

desk verdict Competent systems paper with a real bipartite DeFi-semantics KG and solid post-cutoff numbers, but abstract/body count mismatches and missing artifacts make the headline claims hard to trust at face value. read the letter →

arxiv 2603.26270 v2 pith:VSLF3IZR submitted 2026-03-27 cs.CR cs.AIcs.SE

Ziqiao Kong , Wanxu Xia , Chong Wang , Yue Xue , Yi Lu , Pan Li , Shaohua Li , Zong Cao
show 1 more author
Yang Liu
This is my paper
classification cs.CRcs.AIcs.SE
keywords smartcontractauditingDeFisemanticsknowledgegraphagenticworkflowvulnerabilitydetectionFoundryfuzzingCode4rena
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Smart-contract bugs that drain money are hard to find automatically because they sit inside each project's custom business logic, not in generic code patterns. The authors argue that many of these bugs actually share the same underlying economic mechanisms—what they call DeFi semantics—such as proportional-share token accounting that enables first-depositor attacks. Knowdit therefore builds a bipartite knowledge graph from hundreds of past human audits, linking fine-grained DeFi semantics to recurring vulnerability patterns. When a new project arrives, a multi-agent loop maps the project onto those semantics, turns each semantic-vulnerability pair into an executable Foundry specification and harness, fuzzes it, and reflects on the results until a confirmed exploit or a revised plan is obtained. On a deliberately hard evaluation set of recent contests that post-date the model cutoff, the system recovers every high-severity and most medium-severity ground-truth issues with almost no false positives, and it later uncovers previously unknown high-severity bugs that developers fix before deployment.

What carries the argument

Auditing knowledge graph: a bipartite graph whose DeFi-space nodes (business types, projects, fine-grained economic mechanisms) are linked by many-to-many “may introduce” edges to Vulnerability-space nodes (patterns, findings, attack types); the graph supplies the semantic–vulnerability pairs that drive the agentic auditing loop.

What would settle it

Run the same agentic pipeline on a fresh set of post-cutoff contests after ablating the knowledge graph (or after replacing its causal links with random ones) and check whether high-severity recall collapses below the near-100 % figure reported with the intact graph.

Watch

Extended reading notes

Core claim

Recurring DeFi vulnerabilities share transferable DeFi semantics that can be extracted from historical audit reports into a knowledge graph and then used by an iterative multi-agent loop of specification generation, harness synthesis, fuzzing, and reflection to detect both known and previously unknown high-severity bugs with high precision.

Load-bearing premise

The abstract DeFi semantics and causal links distilled from past audits transfer cleanly enough that language models can turn them into correct, executable Foundry oracles for new projects without fatal hallucination or missing project-specific invariants.

Editorial extensions

If this is right

  • New contests can be audited end-to-end by first retrieving the matching DeFi semantics rather than inventing oracles from scratch.
  • Each confirmed finding can be written back into the graph, so later projects automatically inherit the newly learned pattern.
  • Liquidity-draining attack classes that previously required expert insight become systematically searchable once their DeFi semantic is recorded.
  • Cost of catching a high-severity bug falls from contest-scale bounties to a few tens of dollars of model tokens per project.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same semantic-graph idea could be ported to other domains where business logic, not language bugs, produces the costly failures (for example, payment-protocol or oracle-integration audits).
  • If the graph is kept continuously updated from public reports, the system becomes a living memory that reduces the chance of the same first-depositor-style bug reappearing years later.
  • Human-in-the-loop repair of a single failed harness may be enough to keep precision high while still amortizing most of the specification work across projects.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. Knowdit constructs a bipartite auditing knowledge graph (DeFi Space of business types/projects/semantics linked to Vulnerability Space of patterns/findings/attack types) from 270 historical Code4rena reports via LLM extraction, classification, and deduplication, then applies a multi-agent loop (Knowledge Mapper, Specification Generator producing Initial/Pre-Vuln/Post-Vuln states, Harness Synthesizer for Foundry, Fuzz Executor, Finding Reflector) with shared Working Memory to audit new Solidity projects. On AuditEval (body: 12 post-cutoff projects, 14 high + 61 medium ground-truths) it reports detecting all 14 high and 47/61 medium with 2 FPs, outperforming PropertyGPT, PromFuzz, LLMAudit, and GPTScan; ablation without the graph drops coverage from 88% to 20%; on six real-world projects it claims 12 high + 10 medium developer-confirmed findings. The central claim is that abstract DeFi-semantics knowledge plus agentic fuzzing yields higher-precision, higher-recall automated auditing than prior LLM or invariant baselines.

Significance. If the reported numbers hold, the work is a solid systems contribution to DeFi security: it operationalizes the recurring-semantics observation into a reusable graph (475 semantics, 579 patterns, 2,096 links), couples it to executable Foundry harnesses rather than pure static reasoning, and shows both held-out Code4rena gains and developer-confirmed real-world finds that protect liquidity. Strengths include the temporal split after model cutoffs, the explicit ablation (Knowdit-NKG), side-by-side baseline comparison under a shared $100/project budget, and concrete PoC-style harnesses. These make the paper more than another prompting study and potentially useful to auditors if artifacts are released.

major comments (3)
  1. Abstract vs. body numerical inconsistency is load-bearing for the superiority and impact claims. The abstract states 11 projects / 84 GTs / all 21 high / 90% medium / 0 FP / eight full covers / seven real-world projects / 9 high + 36 medium; Tables 1–2 and §§4.1–4.4 state 12 projects / 75 GTs (14 high + 61 medium) / all 14 high / 47/61 (77%) medium / 2 FP / four full covers / six real-world projects / 12 high + 10 medium. These are not rounding differences; they change headline recall, FP rate, and real-world impact. The manuscript must reconcile or correct every occurrence before the central claim can be trusted.
  2. Reproducibility of the strongest claim is insufficient. No code, knowledge graph dump, generated harnesses, raw traces, or evaluation scripts are released or promised. Given free parameters (token budget, model choice GPT-5.1/GPT-5-mini, regeneration limits) and the false-negative analysis in §4.2.2 (hallucinated harnesses; project-specific invariants not captured by abstract semantics), independent verification of Tables 2–3 and the real-world counts is impossible from the text alone. At minimum the evaluation harnesses, graph schema instance, and per-finding traces for AuditEval should be made available.
  3. §4.2.1 / Table 2 baseline comparison understates practical limitations of the invariant tools. PromFuzz and PropertyGPT are reported near-zero on multi-contract projects, yet the text itself notes they were not designed for end-to-end multi-contract setup without manual intervention. The claim of “significantly outperforming all baselines” is therefore partly an apples-to-oranges comparison of fully agentic end-to-end automation versus tools that expect different oracles or single-contract scopes. A fairer protocol (or an explicit “manual-setup” upper bound for those tools) is needed to support the superiority wording.
minor comments (5)
  1. CCS Concepts and Keywords still contain the ACM placeholder text (“Do Not Use This Code…”); replace with actual terms.
  2. Figure 2 caption and §3.3.1 use “Working Memory” while the abstract mentions a “shared repository index”; align terminology.
  3. §3.2.1 lists 13 business types and 7 attack types without a citation or table of definitions; a short appendix table would aid reproducibility of the classification prompts.
  4. Real-world project X is anonymized (§4.4) while impact claims cite Coingecko/DefiLlama; either de-anonymize after acceptance or quantify impact without named TVL figures that cannot be checked.
  5. Typos and residual template text: “Conference acronym ’XX”, “Trovato et al.” headers, and the 2018 copyright block should be cleaned for camera-ready.

Circularity Check

1 steps flagged · score 1.0 of 10

Empirical systems paper; knowledge graph built from pre-cutoff audits and evaluated on post-cutoff contests with ablation; minor self-citation of authors' prior fuzzing practice does not force detection rates.

  1. self citation load bearing [§3.3.4 Harness Synthesizer]
    "we derive Foundry handlers following the practice from Verite [21] as a thin wrapper of a few external calls to implement the given abstract DeFi semantics."

    Verite is prior work by overlapping authors; the citation supplies the concrete harness style used inside the agentic loop. It is minor and non-load-bearing: the detection rates and ablation gains are measured independently of this engineering choice and do not reduce to the citation by construction.

full rationale

Knowdit is an empirical agentic-systems paper whose central claims are measured detection counts (high/medium recall, false positives, real-world finds) on a temporally held-out Code4rena set (AuditEval) plus developer-confirmed findings. The knowledge graph is constructed from 270 earlier contests via LLM extraction/deduplication/linking and is shown by ablation (Knowdit-NKG) to improve coverage from 20% to 88% and to reduce false positives; the evaluation numbers are therefore not tautological with the graph construction. There are no equations, fitted parameters renamed as predictions, uniqueness theorems, or ansatzes smuggled via self-citation that reduce the reported results by construction. The only self-citations (e.g., Verite for Foundry-handler style, Belobog) supply ordinary engineering practice for harness synthesis and are not load-bearing for the superiority claims. Abstract/body numerical mismatches exist but constitute inconsistency, not circularity. Hence circularity is negligible.

Assumptions & free parameters 3 free parameters · 4 assumptions · 3 invented entities

The central empirical claim rests on domain assumptions about recurring DeFi economic mechanisms, on the fidelity of LLM abstraction/deduplication, and on a handful of operational free parameters (token budget, model choice, repair limits). No new physical entities are postulated; the invented constructs are methodological (DeFi-semantics nodes, the bipartite schema, the three-state auditing specification).

free parameters (3)
  • per-project token budget = $100 (saturation ~$80)
    Fixed at $100 for fair comparison; saturation claimed near $80. Directly controls how many semantic–vulnerability pairs and repair iterations are explored.
  • LLM model choice and defaults = GPT-5.1 / GPT-5-mini, default temperature
    GPT-5.1 for most agents, GPT-5-mini for harness repair; temperature and other hyperparameters left at vendor defaults. Detection rates are conditioned on these opaque models.
  • harness repair / regeneration attempt limit
    Implicit bound on how many times the Working Memory loop re-synthesizes a failing harness or specification before giving up; contributes to residual false negatives.
assumptions (4)
  • domain assumption Recurring smart-contract vulnerabilities across distinct business models share transferable fine-grained economic mechanisms (DeFi semantics).
    Stated as the key insight in §1–2 and used to justify the entire knowledge-graph design; supported by two hand-picked first-depositor examples but not proved exhaustive.
  • domain assumption An LLM can abstract, classify, and deduplicate DeFi semantics and vulnerability patterns from heterogeneous audit reports with sufficient fidelity for later retrieval.
    Stages I–III of §3.2 rely on chain-of-thought prompts without independent human validation of every merged node.
  • domain assumption Code4rena high/medium severity labels after QA filtering constitute a reliable ground-truth oracle for end-to-end evaluation.
    Used throughout RQ1–RQ2; contest incentives and prior automated passes may leave residual label noise.
  • domain assumption Foundry fuzzing with LLM-synthesized handlers and require-oracles is an adequate execution substrate for confirming business-logic violations.
    §3.3.4–3.3.5; inherits limitations of coverage-guided fuzzing on deep multi-contract paths.
invented entities (3)
  • DeFi semantics (fine-grained economic-mechanism nodes)
    purpose: Provide the reusable abstraction layer that links diverse protocol implementations to shared attack surfaces.
    Defined operationally via LLM extraction and merge; 475 nodes claimed after deduplication. Independent evidence is only the authors’ own coverage statistics, not an external ontology.
  • Bipartite auditing knowledge graph (DeFi Space ↔ Vulnerability Space)
    purpose: Store and retrieve may-introduce links between semantics and vulnerability patterns for the agentic loop.
    Schema in Figure 3 is paper-specific; 2 096 links are LLM-validated against historical project–report pairs.
  • Three-state auditing specification (Initial / Pre-Vuln / Post-Vuln)
    purpose: Concretize abstract knowledge into invariants that can be compiled into Foundry setUp and require statements.
    Introduced in §3.3.3; success depends on the LLM correctly instantiating project-specific state variables.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization." pith.science (2026). https://pith.science/paper/VSLF3IZR

@misc{pith2026260326270,
  author       = {Pith},
  title        = {Pith review of: Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VSLF3IZR}},
  note         = {Machine review of arXiv:2603.26270}
}
read the original abstract

Smart contracts govern billions of dollars in decentralized finance (DeFi), yet automated vulnerability detection remains challenging because many vulnerabilities are tightly coupled with project-specific business logic. We observe that recurring vulnerabilities across diverse DeFi business models often share the same underlying economic mechanisms, which we term DeFi semantics, and that capturing these shared abstractions can enable more systematic auditing. Building on this insight, we propose Knowdit, a knowledge-driven, agentic workflow for smart contract vulnerability detection. Knowdit first constructs an auditing knowledge graph from historical human audit reports, linking fine-grained DeFi semantics with recurring vulnerability patterns. Given a new project, a multi-agent pipeline leverages this knowledge through an iterative loop of specification generation, Proof-of-Concept (PoC) synthesis, PoC execution, and finding reflection, driven by a shared repository index. We evaluate Knowdit on 11 recent Code4rena projects with 84 ground-truth vulnerabilities. Knowdit detects all 21 high-severity and 90% of medium-severity vulnerabilities without false positives, fully covering eight projects, significantly outperforming all baselines. Applied to seven real-world projects, Knowdit further discovers 9 high- and 36 medium-severity previously unknown vulnerabilities, securing millions in liquidity and proving its outstanding performance.

Figures

Figures reproduced from arXiv: 2603.26270 by the authors.

Figure 1
Figure 1. Simplified root cause of the recurring “first depos [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The overview of our method Knowdit. 3 Methodology We propose a novel automated approach for smart contract auditing that integrates knowledge extracted from human auditing reports into a multi-agent fuzzing workflow. 3.1 Overview [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The schema of our auditing knowledge graph. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: An example for extracting and merging semantics [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Chain-of-thought style general prompt for classify [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Simplified prompt for extracting DeFi semantics or [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: Simplified prompt for linking DeFi semantics and [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: The vulnerable code in the real-world project [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Progress ratio under different token budgets, where [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

59 extracted references · 2 canonical work pages

  1. [1]

    ERC-4626: Tokenized Vaults

    2021. ERC-4626: Tokenized Vaults. https://eips.ethereum.org/EIPS/eip-4626

    2021

  2. [2]

    Implement or recommend mitigations for ERC4626 inflation attacks

    2022. Implement or recommend mitigations for ERC4626 inflation attacks. https: //github.com/OpenZeppelin/openzeppelin-contracts/issues/3706

    2022

  3. [3]

    2025. Foundry. https://github.com/foundry-rs/foundry

    2025

  4. [4]

    Code4rena

    2026. Code4rena. http://code4rena.com/

    2026

  5. [5]

    Coingecko

    2026. Coingecko. https://www.coingecko.com/. Accessed on March, 2026

    2026

  6. [6]

    DefiLlama

    2026. DefiLlama. https://defillama.com/. Accessed on March, 2026

    2026

  7. [7]

    Hayden Adams, Noah Zinsmeister, and Dan Robinson. 2020. Uniswap v2 Core. https://uniswap.org/whitepaper.pdf

    2020

  8. [8]

    Hayden Adams, Noah Zinsmeister, Moody Salem, River Keefer, and Dan Robinson

Show all 59 references
  1. [9]

    https://app.uniswap.org/whitepaper-v3.pdf

    Uniswap v3 core. https://app.uniswap.org/whitepaper-v3.pdf

  2. [10]

    Priyanka Bose, Dipanjan Das, Yanju Chen, Yu Feng, Christopher Kruegel, and Giovanni Vigna. 2022. Sailfish: Vetting smart contract state-inconsistency bugs in seconds. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 161–178

    2022

  3. [11]

    Chuyang Chen, Brendan Dolan-Gavitt, and Zhiqiang Lin. 2025. ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space. arXiv:2506.10323 [cs.CR] https://arxiv.org/abs/2506.10323

    2025 arXiv

  4. [12]

    Longfei Chen, Ruibin Yan, Taiyu Wong, Yiyang Chen, and Chao Zhang. 2025. SmartPoC: Generating Executable and Validated PoCs for Smart Contract Bug Reports.arXiv preprint arXiv:2511.12993(2025)

    2025

  5. [13]

    Jaeseung Choi, Doyeon Kim, Soomin Kim, Gustavo Grieco, Alex Groce, and Sang Kil Cha. 2021. Smartian: Enhancing smart contract fuzzing with static and dynamic data-flow analyses. In2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 227–23...

    2021 doi

  6. [14]

    Xueying Du, Geng Zheng, Kaixin Wang, Yi Zou, Yujia Wang, Wentai Deng, Jiayi Feng, Mingwei Liu, Bihuan Chen, Xin Peng, Tao Ma, and Yiling Lou. 2025. Vul- RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG. arXiv:2406.11147 [cs.SE] https://arxiv.org/abs/2406.11147

    2025 arXiv

  7. [15]

    Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. 2025. From Local to Global: A Graph RAG Approach to Query-Focused Summarization. arXiv:2404.16130 [cs.CL] https://arxiv....

    2025 arXiv

  8. [16]

    Michael Egorov and Curve Finance. 2021. Automatic market-making with dy- namic peg. https://classic.curve.finance/files/crypto-pools-paper.pdf

    2021

  9. [17]

    Jiaqi Gao, Zijian Zhang, Yuqiang Sun, Ye Liu, Chengwei Liu, Han Liu, Yi Li, and Yang Liu. 2026. LogicScan: An LLM-driven Framework for Detecting Business Logic Vulnerabilities in Smart Contracts. arXiv:2602.03271 [cs.CR] https://arxiv. org/abs/2602.03271

    2026

  10. [18]

    Arthur Gervais and Liyi Zhou. 2026. AI Agent Smart Contract Exploit Generation. arXiv:2507.05558 [cs.CR] https://arxiv.org/abs/2507.05558

    2026

  11. [19]

    David Jin, Qian Fu, and Yuekang Li. 2025. Good News for Script Kid- dies? Evaluating Large Language Models for Automated Exploit Generation. arXiv:2505.01065 [cs.CR] https://arxiv.org/abs/2505.01065

    2025 arXiv

  12. [20]

    Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners.Advances in neural information processing systems35 (2022), 22199–22213

    2022

  13. [21]

    Ziqiao Kong, Wanxu Xia, Zhengwei Li, Yi Lu, Pan Li, Liqun Yang, Yang Liu, Xiapu Luo, and Shaohua Li. 2026. Belobog: Move Language Fuzzing Framework For Real-World Smart Contracts. arXiv:2512.02918 [cs.CR] https://arxiv.org/abs/ 2512.02918

    2026

  14. [22]

    Ziqiao Kong, Cen Zhang, Maoyi Xie, Ming Hu, Yue Xue, Ye Liu, Haijun Wang, and Yang Liu. 2025. Smart Contract Fuzzing Towards Profitable Vulnerabilities. Proceedings of the ACM on Software Engineering2, FSE (2025), 153–175

    2025

  15. [23]

    Dharshan Kumaran, Demis Hassabis, and James L McClelland. 2016. What learning systems do intelligent agents need? Complementary learning systems theory updated.Trends in cognitive sciences20, 7 (2016), 512–534

    2016

  16. [24]

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2021. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. arXiv:2005.1140...

    2021 arXiv

  17. [25]

    Kaixuan Li, Yue Xue, Sen Chen, Han Liu, Kairan Sun, Ming Hu, Haijun Wang, Yang Liu, and Yixiang Chen. 2024. Static application security testing (sast) tools for smart contracts: How far are we?Proceedings of the ACM on Software Engineering1, FSE (2024), 1447–1470

    2024

  18. [26]

    Xiaoqi Li, Hailu Kuang, Wenkai Li, Zongwei Li, and Shipeng Ye. 2025. CKG-LLM: LLM-Assisted Detection of Smart Contract Access Control Vulnerabilities Based on Knowledge Graphs. arXiv:2512.06846 [cs.CR] https://arxiv.org/abs/2512.06846

    2025 arXiv

  19. [27]

    Bo Lin, Shangwen Wang, Yihao Qin, Liqian Chen, and Xiaoguang Mao. 2025. Give LLMs a Security Course: Securing Retrieval-Augmented Code Generation via Knowledge Injection. arXiv:2504.16429 [cs.CR] https://arxiv.org/abs/2504.16429

    2025 arXiv

  20. [28]

    Xingshuang Lin, Qinge Xie, Binbin Zhao, Yuan Tian, Saman Zonouz, Na Ruan, Jiliang Li, Raheem Beyah, and Shouling Ji. 2025. PROMFUZZ: Leveraging LLM- Driven and Bug-Oriented Composite Analysis for Detecting Functional Bugs in Smart Contracts.arXiv preprint arXiv:2503.23718(2025)

    2025

  21. [29]

    Ye Liu, Yue Xue, Daoyuan Wu, Yuqiang Sun, Yi Li, Miaolei Shi, and Yang Liu

  22. [30]

    Propertygpt: Llm-driven formal verification of smart contracts through retrieval-augmented property generation.arXiv preprint arXiv:2405.02580(2024)

    2024 arXiv

  23. [31]

    Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena, and Aquinas Hobor

  24. [32]

    InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security(Vienna, Austria)(CCS ’16)

    Making Smart Contracts Smarter. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security(Vienna, Austria)(CCS ’16). Association for Computing Machinery, New York, NY, USA, 254–269. doi:10. 1145/2976749.2978309

    2016

  25. [33]

    Wei Ma, Daoyuan Wu, Yuqiang Sun, Tianwen Wang, Shangqing Liu, Jian Zhang, Yue Xue, and Yang Liu. 2025. Combining fine-tuning and llm-based agents for intuitive smart contract auditing with justifications. In2025 IEEE/ACM 47th International Conference on Software Engineering (I...

    2025

  26. [34]

    2025.Code Cloning in Solidity Smart Contracts: Prevalence, Evolution, and Impact on Development

    Ran Mo, Haopeng Song, Wei Ding, and Chaochao Wu. 2025.Code Cloning in Solidity Smart Contracts: Prevalence, Evolution, and Impact on Development. IEEE Press, 3060–3071. https://doi.org/10.1109/ICSE55347.2025.00123

    2025 doi

  27. [35]

    Nguyen, Long H

    Tai D. Nguyen, Long H. Pham, Jun Sun, Yun Lin, and Quang Tran Minh

  28. [36]

    arXiv:2004.08563 [cs.SE] https://arxiv.org/abs/2004.08563

    sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts. arXiv:2004.08563 [cs.SE] https://arxiv.org/abs/2004.08563

    2004 arXiv

  29. [37]

    Chenyang Peng, Haijun Wang, Yin Wu, Hao Wu, Ming Fan, Yitao Zhao, and Ting Liu. 2025. ETrace: Event-Driven Vulnerability Detection in Smart Contracts via LLM-Based Trace Analysis. InProceedings of the 16th International Conference on Internetware (Internetware 2025). ACM, 533–...

    2025 doi

  30. [38]

    Chaofan Shou, Shangyin Tan, and Koushik Sen. 2023. Ityfuzz: Snapshot-based fuzzer for smart contract. InProceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis. 322–333. doi:10.1145/3597926. 3598059

    2023 doi

  31. [39]

    Kairan Sun, Zhengzi Xu, Chengwei Liu, Kaixuan Li, and Yang Liu. 2023. Demys- tifying the composition and code reuse in solidity smart contracts. InProceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineerin...

    2023

  32. [40]

    Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Haijun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. 2024. Gptscan: Detecting logic vulnerabilities in smart contracts by combining gpt with program analysis. InProceedings of the IEEE/ACM 46th Conference acronym ’XX, June 03–05, 2018,...

    2024

  33. [41]

    Christof Ferreira Torres, Antonio Ken Iannillo, Arthur Gervais, and Radu State

  34. [42]

    arXiv:2005.12156 [cs.CR] https://arxiv.org/abs/2005.12156

    ConFuzzius: A Data Dependency-Aware Hybrid Fuzzer for Smart Contracts. arXiv:2005.12156 [cs.CR] https://arxiv.org/abs/2005.12156

    2005 arXiv

  35. [43]

    Justin Wang, Andreas Bigger, Xiaohai Xu, Justin W Lin, Andy Applebaum, Tejal Patwardhan, Alpin Yukseloglu, and Olivia Watkins. 2026. EVMbench: Evaluating AI Agents on Smart Contract Security. (2026)

    2026

  36. [44]

    Sally Junsong Wang, Kexin Pei, and Junfeng Yang. 2024. Smartinv: Multimodal learning for smart contract invariant inference. In2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2217–2235

    2024

  37. [45]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems35 (2022), 24824–24837

    2022

  38. [46]

    Zhiyuan Wei, Jing Sun, Yuqiang Sun, Ye Liu, Daoyuan Wu, Zijian Zhang, Xianhao Zhang, Meng Li, Yang Liu, Chunmiao Li, et al. 2025. Advanced smart contract vulnerability detection via llm-powered multi-agent systems.IEEE Transactions on Software Engineering(2025)

    2025

  39. [47]

    Dr Gavin Wood. 2025. ETHEREUM: A SECURE DECENTRALISED GENER- ALISED TRANSACTION LEDGER SHANGHAI VERSION. https://ethereum. github.io/yellowpaper/paper.pdf. (2025)

    2025

  40. [48]

    Di Wu, Wasi Uddin Ahmad, Dejiao Zhang, Murali Krishna Ramanathan, and Xiaofei Ma. 2024. Repoformer: Selective Retrieval for Repository-Level Code Completion. arXiv:2403.10059 [cs.SE] https://arxiv.org/abs/2403.10059

    2024 arXiv

  41. [49]

    Siwei Wu, Zhou Yu, Dabao Wang, Yajin Zhou, Lei Wu, Haoyu Wang, and Xingliang Yuan. 2023. Defiranger: Detecting defi price manipulation attacks. IEEE Transactions on Dependable and Secure Computing21, 4 (2023), 4147–4161

    2023

  42. [50]

    Chunqiu Steven Xia, Matteo Paltenghi, Jia Le Tian, Michael Pradel, and Lingming Zhang. 2024. Fuzz4All: Universal Fuzzing with Large Language Models. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering (ICSE ’24). ACM, 1–13. doi:10.1145/3597503.3639121

    2024 doi

  43. [51]

    Shihao Xia, Shuai Shao, Mengting He, Tingting Yu, Linhai Song, and Yiy- ing Zhang. 2024. AuditGPT: Auditing Smart Contracts with ChatGPT. arXiv:2404.04306 [cs.CR] https://arxiv.org/abs/2404.04306

    2024 arXiv

  44. [52]

    Zeke Xiao, Qin Wang, Yuekang Li, and Shiping Chen. 2025. Prompt to pwn: Automated exploit generation for smart contracts.arXiv preprint arXiv:2508.01371 (2025)

    2025 arXiv

  45. [53]

    Maoyi Xie, Ming Hu, Ziqiao Kong, Cen Zhang, Yebo Feng, Haijun Wang, Yue Xue, Hao Zhang, Ye Liu, and Yang Liu. 2024. Defort: Automatic detection and analysis of price manipulation attacks in defi applications. InProceedings of the 33rd ACM SIGSOFT International Symposium on Sof...

    2024

  46. [54]

    Hanxiang Xu, Yanjie Zhao, and Haoyu Wang. 2025. Directed Greybox Fuzzing via Large Language Model. arXiv:2505.03425 [cs.CR] https://arxiv.org/abs/2505. 03425

    2025 arXiv

  47. [55]

    Fengji Zhang, Bei Chen, Yue Zhang, Jacky Keung, Jin Liu, Daoguang Zan, Yi Mao, Jian-Guang Lou, and Weizhu Chen. 2023. RepoCoder: Repository-Level Code Completion Through Iterative Retrieval and Generation. arXiv:2303.12570 [cs.CL] https://arxiv.org/abs/2303.12570

    2023 arXiv

  48. [56]

    Zhuo Zhang, Brian Zhang, Wen Xu, and Zhiqiang Lin. 2023. Demystifying ex- ploitable bugs in smart contracts. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 615–627. doi:10.1109/ICSE48619.2023.00061

    2023 doi

  49. [57]

    Mengyao Zhao, Kaixuan Li, Lyuye Zhang, Wenjing Dang, Chenggong Ding, Sen Chen, and Zheli Liu. 2025. A Systematic Study on Generating Web Vulnerability Proof-of-Concepts Using Large Language Models. arXiv:2510.10148 [cs.SE] https://arxiv.org/abs/2510.10148

    2025

  50. [58]

    Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. 2023. Sok: Decentralized finance (defi) attacks. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2444–2461. doi:10.1145/...

    2023 doi

  51. [59]

    Hao Zhu, Jia Li, Cuiyun Gao, Jiaru Qian, Yihong Dong, Huanyu Liu, Lecheng Wang, Ziliang Wang, Xiaolong Hu, and Ge Li. 2025. Specification-Guided Vul- nerability Detection with Large Language Models. arXiv:2511.04014 [cs.SE] https://arxiv.org/abs/2511.04014 Received 20 February...

    2025

Pith tools

Reviewed July 13, 2026 · model on record in the stance chip above.