PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts

2025-11-04

AI Summary

Smart contracts operate in adversarial environments, where vulnerabilities can cause substantial financial losses; however, manually crafting proof-of-concept (PoC) exploits is time-consuming, error-prone, and often fails to meet auditing deadlines. To address this, we propose Reason-Act-Observe (RAO), the first autonomous agent framework that enables end-to-end generation of executable PoCs directly from natural-language vulnerability descriptions. RAO operates within a Foundry-based testing environment, dynamically invoking code execution and feedback mechanisms to iteratively reason, act, and observe—thereby synthesizing high-fidelity, functionally correct exploit code. Evaluated on 23 real-world smart contract vulnerabilities, RAO-generated PoCs achieve significantly higher logical correctness and out-of-the-box usability compared to state-of-the-art prompt-engineering and workflow-based approaches. Our method substantially reduces manual effort while improving both auditing efficiency and reliability.

Technology Category

• Multiagent Systems: Adversarial Agents
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Search and Retrieval-Augmented AI: Agentic search

Abstract

Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. In auditing, proof-of-concept (PoC) exploits play a critical role by demonstrating to the stakeholders that the reported vulnerabilities are genuine, reproducible, and actionable. However, manually creating PoCs is time-consuming, error-prone, and often constrained by tight audit schedules. We introduce POCO, an agentic framework that automatically generates executable PoC exploits from natural-language vulnerability descriptions written by auditors. POCO autonomously generates PoC exploits in an agentic manner by interacting with a set of code-execution tools in a Reason-Act-Observe loop. It produces fully executable exploits compatible with the Foundry testing framework, ready for integration into audit reports and other security tools. We evaluate POCO on a dataset of 23 real-world vulnerability reports. POCO consistently outperforms the prompting and workflow baselines, generating well-formed and logically correct PoCs. Our results demonstrate that agentic frameworks can significantly reduce the effort required for high-quality PoCs in smart contract audits. Our contribution provides readily actionable knowledge for the smart contract security community.

Problem

• Automating PoC exploit generation for smart contract vulnerabilities
• Reducing manual effort in creating executable vulnerability demonstrations
• Converting natural-language audit reports into Foundry-compatible test cases

Innovation

• Automatically generates executable exploits from descriptions
• Uses agentic framework with Reason-Act-Observe loop
• Produces Foundry-compatible exploits for audit integration