用定制大模型提升智能合约审计准确率，识别漏洞更准更快。
SmartLLM: Smart Contract Auditing using Custom Generative AI
- 用微调的LLaMA 3.1结合检索增强生成，融合以太坊标准知识。
- 检测漏洞召回率达100%，准确率70%，可发现重入和权限问题。
- 适合区块链安全团队和开发者，提升去中心化应用安全性。
智能合约是去中心化金融（DeFi）和区块链生态系统的核心，但因编码错误和复杂攻击向量，日益易受攻击。传统静态分析工具和现有漏洞检测方法难以全面应对，常导致高误报率且无法发现动态漏洞。本文提出SmartLLM，一种基于微调后的LLaMA 3.1模型与检索增强生成（RAG）的新方法，以提升智能合约审计的准确性和效率。通过整合ERC标准等领域的专有知识，并采用QLoRA实现高效微调，SmartLLM在性能上优于Mythril、Slither等静态分析工具，以及GPT-3.5、GPT-4等零样本提示的大语言模型。实验结果表明，该模型实现了100%的召回率和70%的准确率，能有效识别重入和访问控制等漏洞。本研究推动了智能合约安全技术发展，为去中心化应用的安全落地提供可扩展的审计方案。
原文摘要 · Abstract (English)
Smart contracts are essential to decentralized finance (DeFi) and blockchain ecosystems but are increasingly vulnerable to exploits due to coding errors and complex attack vectors. Traditional static analysis tools and existing vulnerability detection methods often fail to address these challenges comprehensively, leading to high false-positive rates and an inability to detect dynamic vulnerabilities. This paper introduces SmartLLM, a novel approach leveraging fine-tuned LLaMA 3.1 models with Retrieval-Augmented Generation (RAG) to enhance the accuracy and efficiency of smart contract auditing. By integrating domain-specific knowledge from ERC standards and employing advanced techniques such as QLoRA for efficient fine-tuning, SmartLLM achieves superior performance compared to static analysis tools like Mythril and Slither, as well as zero-shot large language model (LLM) prompting methods such as GPT-3.5 and GPT-4. Experimental results demonstrate a perfect recall of 100% and an accuracy score of 70%, highlighting the model's robustness in identifying vulnerabilities, including reentrancy and access control issues. This research advances smart contract security by offering a scalable and effective auditing solution, supporting the secure adoption of decentralized applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。