Automated Vulnerability Injection in Smart Contracts Using Large Language Models

2026-09-02

AI Summary

研究提出使用大型语言模型自动向Solidarity智能合约注入漏洞，以生成评估工具所需的数据集，并通过多步骤验证流程确保合约的有效性和预期漏洞的存在。

Abstract

Assessing vulnerability detection tools for smart contracts requires datasets with known ground truth, yet such datasets are scarce and difficult to build by hand. We propose an approach that uses Large Language Models (LLMs) to automatically inject vulnerabilities into Solidity smart contracts, and demonstrate it in a case study targeting 49 vulnerability types from OpenSCV. Injected contracts are validated through a multi-step pipeline checking compilation, execution, business logic, and the presence of the intended vulnerability. Applied to real-world contracts from SmartBugs, LLMs generate nearly 1,000 candidate variants; after deduplication and validation, 32 confirmed vulnerable contracts spanning 25 vulnerability types survive (a 16.58% survival rate). Surviving contracts concentrate in structurally simpler targets and vulnerability types with localized syntactic patterns. We report practical challenges including LLMs' non-determinism and the difficulty of preserving contract semantics. We then use the validated contracts to assess three static analyzers, revealing complementary and incomplete coverage profiles. Results show that LLM-based vulnerability injection is feasible, while exposing key limitations in scalability and diversity.

Problem

• vulnerability detection
• smart contracts
• datasets
• ground truth

Innovation

• Large Language Models
• Automated Vulnerability Injection
• Smart Contracts
• Vulnerability Detection