用审计知识图谱提升智能合约漏洞检测,精准发现高危问题。
Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization
- 构建审计知识图谱,关联去中心化金融语义与常见漏洞模式。
- 在11个Code4rena项目中检出全部21个高危漏洞,中危漏洞检测率达90%。
- 实测发现9个高危、36个中危未知漏洞,适合安全审计与开发团队使用。
智能合约管理着数十亿美元的去中心化金融(DeFi)资产,但自动化漏洞检测仍具挑战性,因许多漏洞紧密耦合于项目特有的业务逻辑。我们观察到,不同DeFi业务模式中的重复漏洞常共享相同的底层经济机制,称为DeFi语义;捕捉这些共性抽象可实现更系统的审计。基于此洞察,我们提出Knowdit,一种基于知识的代理式智能合约漏洞检测工作流。Knowdit首先从历史人工审计报告构建审计知识图谱,将细粒度DeFi语义与重复出现的漏洞模式关联。针对新项目,多代理流水线通过规范生成、PoC合成、执行及发现反馈的迭代循环,利用共享索引库进行推理。我们在11个近期Code4rena项目上评估Knowdit,其检测出全部21个高严重性漏洞和90%的中等严重性漏洞,无误报,完全覆盖8个项目,显著优于所有基线。应用于7个真实项目时,又发现9个高危和36个中危未知漏洞,保障数百万流动性安全,证明其卓越性能。
原文摘要 · Abstract (English)
Smart contracts govern billions of dollars in decentralized finance (DeFi), yet automated vulnerability detection remains challenging because many vulnerabilities are tightly coupled with project-specific business logic. We observe that recurring vulnerabilities across diverse DeFi business models often share the same underlying economic mechanisms, which we term DeFi semantics, and that capturing these shared abstractions can enable more systematic auditing. Building on this insight, we propose Knowdit, a knowledge-driven, agentic workflow for smart contract vulnerability detection. Knowdit first constructs an auditing knowledge graph from historical human audit reports, linking fine-grained DeFi semantics with recurring vulnerability patterns. Given a new project, a multi-agent pipeline leverages this knowledge through an iterative loop of specification generation, Proof-of-Concept (PoC) synthesis, PoC execution, and finding reflection, driven by a shared repository index. We evaluate Knowdit on 11 recent Code4rena projects with 84 ground-truth vulnerabilities. Knowdit detects all 21 high-severity and 90% of medium-severity vulnerabilities without false positives, fully covering eight projects, significantly outperforming all baselines. Applied to seven real-world projects, Knowdit further discovers 9 high- and 36 medium-severity previously unknown vulnerabilities, securing millions in liquidity and proving its outstanding performance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。