LibScan: Smart Contract Library Misuse Detection with Iterative Feedback and Static Verification

2026-04-01

AI Summary

This work addresses the critical yet often overlooked issue of third-party library misuse in smart contracts, which can introduce subtle vulnerabilities leading to severe financial losses. Existing detection tools suffer from limited accuracy, prompting the proposal of LibScan—a novel framework that uniquely integrates large language model–based semantic reasoning with rule-driven static analysis. By leveraging an iterative self-correction mechanism and a structured knowledge base empirically constructed from real-world patterns, LibScan precisely identifies eight categories of library misuse. Evaluated on 662 real-world smart contracts, LibScan achieves an overall accuracy of 85.15%, outperforming state-of-the-art methods by more than 16 percentage points. Ablation studies further confirm the effectiveness and generalizability of its multi-technique fusion approach.

Abstract

Smart contracts are self-executing programs that manage financial transactions on blockchain networks. Developers commonly rely on third-party code libraries to improve both efficiency and security. However, improper use of these libraries can introduce hidden vulnerabilities that are difficult to detect, leading to significant financial losses. Existing automated tools struggle to identify such misuse because it often requires understanding the developer's intent rather than simply scanning for known code patterns. This paper presents LibScan, an automated detection framework that combines large language model (LLM)-based semantic reasoning with rule-based code analysis, identifying eight distinct categories of library misuse in smart contracts. To improve detection reliability, the framework incorporates an iterative self-correction mechanism that refines its analysis across multiple rounds, alongside a structured knowledge base derived from large-scale empirical studies of real-world misuse cases. Experiments conducted on 662 real-world smart contracts demonstrate that LibScan achieves an overall detection accuracy of 85.15\%, outperforming existing tools by a margin of over 16 percentage points. Ablation experiments further confirm that combining both analysis approaches yields substantially better results than either method used independently.

Problem

• smart contract
• library misuse
• vulnerability detection
• code analysis
• developer intent

Innovation

• library misuse detection
• large language model
• iterative feedback
• static verification
• smart contract security