Detecting State Manipulation Vulnerabilities in Smart Contracts Using LLM and Static Analysis

2025-06-10

AI Summary

Economic attacks on DeFi smart contracts—caused by malicious manipulation of price variables—pose severe security risks. To address this, we propose PriceSleuth, an LLM-guided static analysis framework that deeply integrates large language models into program dependence graph construction and variable propagation tracking. PriceSleuth semantically identifies core price-computation logic, performs backward data-dependence slicing to trace price inputs, and models cross-function propagation paths of price variables within contracts. Unlike conventional static analyzers, PriceSleuth establishes the first closed-loop synergy between LLMs and program analysis, significantly improving detection accuracy and interpretability for subtle price-manipulation vulnerabilities—including oracle price tampering and exploitative misuse of liquidity pool states. Evaluated on mainstream DeFi contracts, PriceSleuth achieves substantially higher vulnerability recall and precision compared to state-of-the-art baseline tools.

Technology Category

• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Search and Optimization: Learning to Search
• Machine Learning: Large Multimodal Models (LMMs)

Application Category

• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems
• Security and Privacy: Cryptocurrency and smart contracts
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

An increasing number of DeFi protocols are gaining popularity, facilitating transactions among multiple anonymous users. State Manipulation is one of the notorious attacks in DeFi smart contracts, with price variable being the most commonly exploited state variable-attackers manipulate token prices to gain illicit profits. In this paper, we propose PriceSleuth, a novel method that leverages the Large Language Model (LLM) and static analysis to detect Price Manipulation (PM) attacks proactively. PriceSleuth firstly identifies core logic function related to price calculation in DeFi contracts. Then it guides LLM to locate the price calculation code statements. Secondly, PriceSleuth performs backward dependency analysis of price variables, instructing LLM in detecting potential price manipulation. Finally, PriceSleuth utilizes propagation analysis of price variables to assist LLM in detecting whether these variables are maliciously exploited. We presented preliminary experimental results to substantiate the effectiveness of PriceSleuth . And we outline future research directions for PriceSleuth.

Problem

• Detects state manipulation vulnerabilities in DeFi smart contracts
• Identifies price calculation logic for manipulation risks
• Combines LLM and static analysis for proactive attack detection

Innovation

• Leverages LLM and static analysis
• Identifies core price calculation functions
• Performs backward dependency analysis