arXiv:2509.19153cs.CRcs.AI2025-09被引 2

用大模型检测以太坊智能合约逻辑错误,效果出人意料。

LLMs as verification oracles for Solidity

  • 用GPT-5分析合约特定性质的真假,替代传统验证工具
  • 在真实审计场景中,预测准确率接近专业工具水平
  • 适合安全审计人员快速评估合约逻辑缺陷

确保智能合约正确性至关重要,微小漏洞可能引发重大财务损失。尽管漏洞检测工具可识别常见模式,但多数实际攻击源于业务逻辑错误。形式化验证工具如SolCMC和Certora Prover虽能应对此问题,但受限于学习成本高与规范语言僵硬。近期研究探索使用大语言模型(LLMs)进行漏洞检测与测试生成。本文首次系统评估GPT-5在判断任意合约特定性质有效性方面的表现。我们在大规模验证任务数据集上进行基准测试,对比其输出与传统形式化工具结果,并评估其在真实审计中的实用性。研究结合定量与定性分析,表明当前推理型大模型虽无严谨证明保证,但在预测复杂性质真伪方面表现惊人,预示着人工智能与形式化方法融合的新方向,推动安全合约开发与审计进步。

原文摘要 · Abstract (English)

Ensuring the correctness of smart contracts is critical, as even subtle flaws can lead to severe financial losses. While bug detection tools able to spot common vulnerability patterns can serve as a first line of defense, most real-world exploits and losses stem from errors in the contract business logic. Formal verification tools such as SolCMC and the Certora Prover address this challenge, but their impact remains limited by steep learning curves and restricted specification languages. Recent works have begun to explore the use of large language models (LLMs) for security-related tasks such as vulnerability detection and test generation. Yet, a fundamental question remains open: can LLMs aid in assessing the validity of arbitrary contract-specific properties? In this paper, we provide the first systematic empirical evaluation of GPT-5, a state-of-the-art reasoning LLM, in this role. We benchmark its performance on a large dataset of verification tasks, compare its outputs against those of established formal verification tools, and assess its practical effectiveness in real-world auditing scenarios. Our study combines quantitative metrics with qualitative analysis, and shows that recent reasoning-oriented LLMs - although lacking soundness guarantees - can be surprisingly effective at predicting the (in)validity of complex properties, suggesting a new frontier in the convergence of AI and formal methods for secure smart contract development and auditing.

智能合约大模型形式验证安全审计

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。