Problem
Research questions and friction points this paper is trying to address.
Smart Contracts
LLM-based Vulnerability Scanning
Public Source Disclosure
Blockchain Security
When Verified Source Becomes Attack Input: Defending Smart Contracts Against LLM-Based Vulnerability Scanning
🤖 AI Summary
本文提出DeLLMGuard框架，通过分离公开源代码与运行时执行来防御基于大语言模型的恶意漏洞扫描，同时保持源代码公开和授权审计。
📝 Abstract
Smart contracts are financial programs deployed on blockchains to manage digital assets. To build trust with users and investors, smart contract projects typically publish their source code on blockchain explorers and verify it against the deployed bytecode, making the on-chain program accessible through a human-readable implementation. However, LLM agents are changing the threat model of this disclosure mechanism. By leveraging publicly disclosed source code, recent agent workflows make it increasingly practical to scan contract vulnerabilities for exploits at large scale.
In this paper, we propose DeLLMGuard, a smart contract deployment framework that defends against malicious LLM-based vulnerability scanning while preserving public source disclosure and authorized auditing. DeLLMGuard can separate disclosed source code from runtime execution through multiple contract addresses in a real-world blockchain environment. LLM agents must therefore recover additional proxy, delegate, and factory relations before vulnerability analysis. A built-in Verification Layer checks deployment relations, runtime bytecode, source code, and state changes to ensure that the transformation preserves the original business implementation. We evaluate DeLLMGuard on 387 real-world vulnerable contracts with three LLM agents in an environment derived from SCONE-bench. DeLLMGuard reduces overall root-cause correctness from 23.5% to 6.6% and outperforms the closed-source bytecode baseline on the primary non-proxy set. Trace and ablation analyses further show that agents often recover downstream contracts but still fail to identify the vulnerability, indicating that cross-contract recovery remains a major challenge for automated LLM scanning.
Innovation
Methods, ideas, or system contributions that make the work stand out.
DeLLMGuard
smart contract security
LLM-based vulnerability scanning
public source disclosure
blockchain
🔎 Similar Papers
No similar papers found.
💼 Related Jobs
No related jobs found.
