A Bounded Game Semantics Checker for Precise Smart Contract Analysis

2025-12-26

AI Summary

Static detection of smart contract vulnerabilities—such as reentrancy—suffers from high false-positive rates and poor scalability. Method: This paper proposes a precise static analysis framework based on bounded game semantics: it models contract execution as an interactive two-player game between the contract and its environment, and achieves zero false positives (up to the EVM-Yul interpreter layer) and bounded completeness by enumerating all feasible bounded execution traces. It is the first work to introduce game semantics into smart contract analysis, enabling Solidity-level domain knowledge injection and automatic propagation to the Yul intermediate representation. The approach integrates Solidity-to-Yul instrumentation with full-trace exploration optimizations to enhance scalability without sacrificing precision. Results: The method successfully reproduces known vulnerabilities and generates executable triggering traces for real-world contracts—including The DAO, PredyPool, and Lendf.Me—and confirms zero false positives post-fixing. Benchmark evaluations demonstrate both high precision and practical applicability.

Technology Category

• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Game Theory and Economic Paradigms: Mechanism Design
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Abstract

We present a new approach to finding smart contract vulnerabilities that is precise (no false positives up to our EVM-Yul interpreter), bounded-complete, and, when instrumented with domain knowledge, scales to real-world contracts. Our method is based on game semantics, modelling computation as an interaction between a contract and its environment, reducing reasoning about unknown or malicious external contracts to trace enumeration. We implement this in a tool we refer to as YulToolkit, a bounded game-semantics checker for Yul, the intermediate language of Solidity. By exploring only feasible interactions, YulToolkit avoids over-approximation, and by relying on the theory of game semantics it achieves bounded completeness. To make exploration tractable, YulToolkit supports instrumentation written in Solidity and propagated to Yul, comparable in effort to creating a test harness. Unlike tests, however, our technique explores all admissible traces within the chosen parameters and bounds. We evaluate YulToolkit on three real-world incidents: The DAO, PredyPool, and Lendf.Me, as well as benchmark contracts. In all cases, YulToolkit detects the known vulnerabilities (producing a violation-triggering trace), and after applying fixes, reports no further violations within bounds. These results show that bounded game semantics exploration is an effective and precise addition to the smart contract analysis toolbox, particularly for vulnerabilities such as reentrancy that are hard to detect precisely in real code.

Problem

• Detects smart contract vulnerabilities without false positives
• Models contract-environment interactions using game semantics
• Scales to real-world contracts with domain knowledge instrumentation

Innovation

• Game semantics models contract-environment interaction
• Bounded completeness ensures precise vulnerability detection
• Solidity instrumentation enables scalable real-world analysis