用结构化代码分析提升智能合约审计准确率,减少大模型误报。
CHAINTRIX: A multi-pipeline LLM-augmented framework for automated smart-contract security auditing
- 构建结构化合约表示,强制大模型结论可验证
- 在EVMbench上检测71.7%高危漏洞,超基线26个百分点
- 适合安全团队与开发者快速筛查合约风险
智能合约漏洞已导致数十亿美元损失,但人工审计成本高、耗时长。自动化工具虽有进展,但各类方法各有缺陷:静态分析误报率高,大语言模型(LLM)常产生与源码矛盾的幻觉。为此,我们提出Chaintrix,一种端到端审计框架,核心是所有LLM生成的断言必须基于确定性的结构化合约表示进行验证。我们引入跨合约交互模型(CCIM),将Solidity代码解析为函数级读写、修饰符和合约调用的结构化映射。该结构化表示作为基础,支撑12个确定性信号引擎和并行的LLM审计管道。通过分阶段的误报过滤流程,最终由结构化判定引擎(SVE)执行确定性检查,并对高置信度发现进行符号执行和模糊测试验证。我们在OpenAI、Paradigm、OtterSec联合发布的EVMbench基准上评估,Chaintrix成功检测出120个高危漏洞中的86个(召回率71.7%),其中25次审计达到100%召回率,较最强前沿模型基线高出26个百分点。
原文摘要 · Abstract (English)
Smart-contract exploits have caused billions of USD in cumulative losses, yet audits remain expensive and slow. Automated tools have emerged to close this gap, but each class has a characteristic failure mode. Static analyzers report findings that frequently fail manual triage at high rates, while large language models (LLMs) hallucinate findings that contradict the source code. Thus, we propose Chaintrix, an end-to-end auditing framework whose central architectural commitment is that every LLM-generated claim must be discharged against a deterministic structural contract representation. We introduce a Cross-Contract Interaction Model (CCIM) that parses Solidity into a structured map of function-level reads, writes, modifiers and resolved cross-contract calls. CCIM serves as the substrate against which all 12 of Chaintrix's deterministic signal engines and the parallel LLM audit pipelines operate. A staged false-positive-reduction pipeline, terminating in a Structural Verdict Engine (SVE) that applies deterministic structural checks against parsed code, filters the merged finding set, with selected high-confidence findings further validated through symbolic execution and fuzz testing. We evaluate Chaintrix on EVMbench, the smart-contract security benchmark by OpenAI, Paradigm, OtterSec. Chaintrix detects 86 of 120 high-severity vulnerabilities (71.7% recall), with 25 audits scoring 100% recall, placing Chaintrix 26 percentage points above the strongest frontier-model baseline.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。