PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement
Pith reviewed 2026-05-10 17:55 UTC · model grok-4.3
The pith
PSR² detects atomicity violations in smart contracts by combining control-flow path searches with semantic state analysis.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
PSR² is a collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning. It employs a Graph Structure Analysis Module to identify suspicious execution sequences in control flow graphs, a Semantic Context Analysis Module to extract data dependencies and state facts from abstract syntax trees, and a Fusion Decision Module to perform formal cross validation based on a unified atomicity inconsistency model. This results in superior detection performance on complex contracts.
What carries the argument
The Fusion Decision Module, which cross-validates structural paths from control-flow graphs against semantic facts from syntax trees using a unified atomicity inconsistency model.
If this is right
- Atomicity issues in Oracle and NFT contracts become detectable with far fewer missed cases than pattern-matching methods allow.
- False-positive rates drop by nearly half when structural sequence checks are fused with semantic dependency facts.
- The same pipeline applies across 1,600 varied contract samples while preserving high accuracy on ERC-721 logic.
- Existing static analyzers can be strengthened by adding a semantic reasoning layer before final classification.
Where Pith is reading between the lines
- The hybrid structural-semantic approach may apply to other state-dependent vulnerabilities that appear only after intermediate contract steps.
- Embedding the modules into a contract development environment could let authors catch atomicity problems during writing rather than after deployment.
- Refining the inconsistency model further might capture additional context-specific patterns that current cross-validation still overlooks.
Load-bearing premise
The unified atomicity inconsistency model can reliably confirm vulnerabilities through cross-validation of structural and semantic analyses without missing context-dependent cases.
What would settle it
Evaluating the framework on a new collection of 500 ERC-721 contracts that contain independently verified atomicity violations and obtaining an F1 score below 80 percent would show the performance advantage does not hold.
Figures
read the original abstract
With the rapid advancement of decentralized applications, smart contract security faces severe challenges, particularly regarding atomicity violations in complex logic such as Oracle and NFT contracts. Rigid rule sets often limit traditional static analyzers and lack deep contextual awareness, leading to high false-positive and false-negative rates when identifying vulnerabilities that depend on intermediate state inconsistencies. To address these limitations, this paper proposes PSR\textsuperscript{2}, a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning. PSR\textsuperscript{2} utilizes a Graph Structure Analysis Module (GSAM) to identify suspicious execution sequences in control flow graphs and a Semantic Context Analysis Module (SCAM) to extract data dependencies and state facts from abstract syntax trees. A Fusion Decision Module (FDM) then performs formal cross validation to confirm vulnerabilities based on a unified atomicity inconsistency model. Experimental results on 1,600 contract samples demonstrate that PSR\textsuperscript{2} significantly outperforms pattern-matching baselines, achieving an F1-score of 94.69\% in complex ERC-721 scenarios compared to 51.86\% for existing tools. Ablation studies further confirm that our fusion logic effectively reduces the false-positive rate by nearly half compared to single module analysis.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript presents PSR², a collaborative static analysis framework for detecting atomicity violations in smart contracts. It integrates a Graph Structure Analysis Module (GSAM) to find suspicious paths in control flow graphs, a Semantic Context Analysis Module (SCAM) to extract state facts and dependencies from abstract syntax trees, and a Fusion Decision Module (FDM) that applies a unified atomicity inconsistency model for formal cross-validation of structural and semantic analyses. The authors claim that on a dataset of 1,600 contract samples, PSR² achieves an F1-score of 94.69% in complex ERC-721 scenarios, significantly outperforming pattern-matching baselines at 51.86%, and that ablation studies show the fusion logic halves the false-positive rate.
Significance. Should the experimental claims hold under scrutiny, the work would represent a meaningful advance in smart contract vulnerability detection by moving beyond rigid pattern matching to a hybrid structural-semantic approach. This could be particularly valuable for identifying subtle atomicity issues in DeFi and NFT contracts that depend on intermediate state inconsistencies, potentially improving the reliability of automated security tools in the blockchain ecosystem.
major comments (2)
- Abstract and Experimental Evaluation: The headline performance numbers (F1-score of 94.69% on 1,600 samples vs. 51.86% for baselines) are presented without any description of dataset construction, baseline implementations, precise evaluation metrics, or the procedure used to measure false positives. This absence makes the central empirical claim impossible to verify or reproduce.
- Fusion Decision Module (FDM) description: The unified atomicity inconsistency model is said to perform 'formal cross validation' to confirm vulnerabilities, yet the manuscript supplies no formal definition of the model, no enumeration of the inconsistency patterns it covers, and no completeness argument. This directly bears on whether the reported F1 scores reflect general soundness or merely coverage of the particular 1,600-sample dataset, especially for context-dependent cases such as oracle-dependent updates or external-call effects not captured in AST/CFG facts.
minor comments (1)
- The abstract is dense with technical terms (GSAM, SCAM, FDM, PSR²) introduced without a brief forward reference to their definitions in the main text; a short expansion would aid readability.
Simulated Author's Rebuttal
We thank the referee for the constructive comments, which identify key areas where additional detail will strengthen the manuscript's clarity, reproducibility, and formal grounding. We address each major comment below and will incorporate the suggested revisions in the next version of the paper.
read point-by-point responses
-
Referee: Abstract and Experimental Evaluation: The headline performance numbers (F1-score of 94.69% on 1,600 samples vs. 51.86% for baselines) are presented without any description of dataset construction, baseline implementations, precise evaluation metrics, or the procedure used to measure false positives. This absence makes the central empirical claim impossible to verify or reproduce.
Authors: We agree that the experimental claims require substantially more detail to support verification and reproducibility. In the revised manuscript we will expand the Experimental Evaluation section (and update the abstract accordingly) to include: (1) a full description of dataset construction, including data sources, collection criteria, labeling process for the 1,600 samples, and any stratification by contract type (e.g., ERC-721); (2) explicit implementation details for all baselines, including tool names, versions, configuration parameters, and how pattern-matching rules were applied; (3) precise definitions and formulas for all reported metrics (precision, recall, F1-score) together with the exact evaluation protocol; and (4) the procedure used to identify and count false positives, including manual verification steps. These additions will directly address the verifiability concern. revision: yes
-
Referee: Fusion Decision Module (FDM) description: The unified atomicity inconsistency model is said to perform 'formal cross validation' to confirm vulnerabilities, yet the manuscript supplies no formal definition of the model, no enumeration of the inconsistency patterns it covers, and no completeness argument. This directly bears on whether the reported F1 scores reflect general soundness or merely coverage of the particular 1,600-sample dataset, especially for context-dependent cases such as oracle-dependent updates or external-call effects not captured in AST/CFG facts.
Authors: We acknowledge that the current description of the FDM and the underlying unified atomicity inconsistency model is insufficiently formal. In the revision we will add: (1) a precise mathematical definition of the model, including its input facts from GSAM and SCAM and the cross-validation rules; (2) an explicit enumeration of the inconsistency patterns it recognizes; and (3) a completeness discussion that states the model's scope and limitations, explicitly addressing context-dependent scenarios such as oracle-dependent state updates and external-call effects that may not be fully captured by AST/CFG facts alone. This will clarify the conditions under which the reported F1 scores can be expected to generalize. revision: yes
Circularity Check
No circularity: independent modules and empirical results
full rationale
The paper presents PSR² as a collaborative static analysis framework with three distinct modules (GSAM for path searching in CFGs, SCAM for data dependencies in ASTs, and FDM for cross-validation via a unified atomicity inconsistency model) whose outputs are fused to detect vulnerabilities. Experimental claims rest on evaluation against 1,600 contract samples and comparison to pattern-matching baselines, with no equations, parameter fitting, self-citations, or ansatzes shown that reduce any result to its own inputs by construction. The derivation chain is self-contained against external benchmarks.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption The unified atomicity inconsistency model accurately captures vulnerabilities from intermediate state inconsistencies
Reference graph
Works this paper leans on
-
[1]
Syed Badruddoja, Ram Dantu, Yanyan He, Kritagya Upadhayay, and Mark Thomp- son. 2021. Making smart contracts smarter. In2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC). IEEE, 1–3
work page 2021
- [2]
-
[3]
Giulio Caldarelli. 2025. Can artificial intelligence solve the blockchain oracle problem? unpacking the challenges and possibilities.Frontiers in Blockchain8 (2025), 1682623
work page 2025
-
[4]
Yuanlong Cao, Fan Jiang, Jianmao Xiao, Shaolong Chen, Wei Yang, and Yugen Yi. 2023. Data flow-driven and attention mechanism-enabled smart contract vulnerability detection for secure and green blockchain-based service networks. InICC 2023-IEEE International Conference on Communications. IEEE, 5135–5140
work page 2023
-
[5]
Ethan Cecchetti, Siqiu Yao, Haobin Ni, and Andrew C Myers. 2021. Compositional security for reentrant applications. In2021 IEEE Symposium on Security and Privacy (SP). IEEE, 1249–1267
work page 2021
-
[6]
Dipanjan Das, Priyanka Bose, Nicola Ruaro, Christopher Kruegel, and Giovanni Vigna. 2022. Understanding security issues in the NFT ecosystem. InProceedings of the 2022 ACM SIGSAC conference on computer and communications security. 667–681
work page 2022
-
[7]
Thomas Durieux, João F Ferreira, Rui Abreu, and Pedro Cruz. 2020. Empirical review of automated analysis tools on 47,587 ethereum smart contracts. InPro- ceedings of the ACM/IEEE 42nd International conference on software engineering. 530–541
work page 2020
-
[8]
Shayan Eskandari, Mehdi Salehi, Wanyun Catherine Gu, and Jeremy Clark. 2021. Sok: Oracles from the ground truth to market manipulation. InProceedings of the 3rd ACM Conference on Advances in Financial Technologies. 127–141
work page 2021
-
[9]
Josselin Feist, Gustavo Grieco, and Alex Groce. 2019. Slither: a static analysis framework for smart contracts. In2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB). IEEE, 8–15
work page 2019
-
[10]
Asem Ghaleb. 2022. Towards effective static analysis approaches for security vul- nerabilities in smart contracts. InProceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering. 1–5
work page 2022
- [11]
-
[12]
Neville Grech, Lexi Brent, Bernhard Scholz, and Yannis Smaragdakis. 2019. Giga- horse: thorough, declarative decompilation of smart contracts. In2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE). IEEE, 1176–1186
work page 2019
-
[13]
Jiaxing Guo, Dongliang Zhao, Chunxiang Gu, Xi Chen, Xieli Zhang, and Mengcheng Ju. 2024. An enhanced state-aware model learning approach for security analysis in lightweight protocol implementations.Journal of Cloud Computing13, 1 (2024), 28
work page 2024
-
[14]
Sowon Jeon, Gilhee Lee, Hyoungshick Kim, and Simon S Woo. 2024. Design and evaluation of highly accurate smart contract code vulnerability detection framework.Data Mining and Knowledge Discovery38, 3 (2024), 888–912
work page 2024
-
[15]
Kashif Mehboob Khan and Ansha Zahid. 2022. Empirical analysis of vulnerabili- ties in blockchain-based smart contracts.Sir Syed University Research Journal of Engineering & Technology12, 1 (2022), 78–85
work page 2022
-
[16]
Kaixuan Li, Yue Xue, Sen Chen, Han Liu, Kairan Sun, Ming Hu, Haijun Wang, Yang Liu, and Yixiang Chen. 2024. Static application security testing (sast) tools for smart contracts: How far are we?Proceedings of the ACM on Software Engineering1, FSE (2024), 1447–1470
work page 2024
-
[17]
Lantian Li, Yuyu Chen, Jingwen Wu, Yue Pan, and Zhongxing Yu. 2025. Un- derstanding inconsistent state update vulnerabilities in smart contracts.ACM Transactions on Software Engineering and Methodology(2025)
work page 2025
-
[18]
Yinxi Liu, Wei Meng, and Yinqian Zhang. 2025. Detecting smart contract state- inconsistency bugs via flow divergence and multiplex symbolic execution.Pro- ceedings of the ACM on Software Engineering2, FSE (2025), 22–43
work page 2025
-
[19]
Zhenkun Luo, Shuhong Chen, Guojun Wang, and Hanjun Li. 2023. Two-Stage Smart Contract Vulnerability Detection Combining Semantic Features and Graph Features. In2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 257–264
work page 2023
-
[20]
Deepa Mishra and Shraddha Phansalkar. 2025. Blockchain Security in Focus: A Comprehensive Investigation into Threats, Smart Contract Security, Cross-Chain Bridges, Vulnerabilities Detection Tools & Techniques.IEEE Access(2025)
work page 2025
-
[21]
Hongli Peng, Wenkai Li, Chunyi Zhang, Xiaoqi Li, and Yuqing Zhang. 2026. TriFortis: Fortifying Erroneous Control Flow Vulnerability Detection in Smart Contracts with Multimodal Deep Learning.Blockchain: Research and Applications (2026), 100478
work page 2026
-
[22]
Peng Qian, Zhenguang Liu, Qinming He, Roger Zimmermann, and Xun Wang
-
[23]
Towards automated reentrancy detection for smart contracts based on sequential models.IEEE access8 (2020), 19685–19695
work page 2020
-
[24]
A Sasikumar, Logesh Ravi, Malathi Devarajan, A Selvalakshmi, Abdulaziz Turki Almaktoom, Abdulaziz S Almazyad, Guojiang Xiong, and Ali Wagdy Mohamed
-
[25]
Blockchain-assisted hierarchical attribute-based encryption scheme for secure information sharing in industrial internet of things.IEEe Access12 (2024), 12586–12601
work page 2024
-
[26]
Qiyang Song, Heqing Huang, Xiaoqi Jia, Yuanbo Xie, and Jiahao Cao. 2025. Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection. InNDSS
work page 2025
-
[27]
Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Haijun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. 2024. Gptscan: Detecting logic vulnerabilities in smart contracts by combining gpt with program analysis. InProceedings of the IEEE/ACM 46th International Conference on Software Engineering. 1–13
work page 2024
-
[28]
Yuechen Tao, Bo Li, and Baochun Li. 2023. On atomicity and confidentiality across blockchains under failures.IEEE Transactions on Knowledge and Data Engineering36, 2 (2023), 766–780
work page 2023
-
[29]
Sergei Tikhomirov, Ekaterina Voskresenskaya, Ivan Ivanitskiy, Ramil Takhaviev, Evgeny Marchenko, and Yaroslav Alexandrov. 2018. Smartcheck: Static analysis of ethereum smart contracts. InProceedings of the 1st international workshop on emerging trends in software engineering for blockchain. 9–16
work page 2018
-
[30]
Arianna Trozze, Bennett Kleinberg, and Toby Davies. 2024. Detecting DeFi securities violations from token smart contract code.Financial Innovation10, 1 (2024), 1–35
work page 2024
-
[31]
Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Buenzli, and Martin Vechev. 2018. Securify: Practical security analysis of smart contracts. InProceedings of the 2018 ACM SIGSAC conference on computer and communications security. 67–82
work page 2018
-
[32]
Anusha Vangala, Anil Kumar Sutrala, Ashok Kumar Das, and Minho Jo. 2021. Smart contract-based blockchain-envisioned authentication scheme for smart farming.IEEE Internet of Things Journal8, 13 (2021), 10792–10806
work page 2021
-
[33]
Shrey Varma, Sachin Prajapati, YashKumar Gupta, Kaushik Tondon, Shraddha Sharma, Manali Parate, and Manasi Churi. 2025. NFT Marketplaces: A Compre- hensive Analysis of Trading, Security, and Metadata Challenges.International Journal on Advanced Electrical and Computer Engineering14, 1 (2025), 55–68
work page 2025
-
[34]
Bin Wang, Shan Li, Xiaohan Yuan, Xueshuo Xie, Junyong Wang, Tao Li, and Wei Wang. 2025. ContractScanner: Detecting and Localizing Vulnerabilities of Smart Contracts via Graph-Based Semantic Modeling of Source Code.IEEE Transactions on Network Science and Engineering(2025)
work page 2025
-
[35]
Long Wang, Zhihua Chen, Hua Pang, and Xiaoguang Li. 2024. Smart Contract Vulnerability Detection via Feature Fusion of Local Data Flow and Global Features. In2024 IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA). IEEE, 2268–2271
work page 2024
-
[36]
Zhiyuan Wei, Jing Sun, Yuqiang Sun, Ye Liu, Daoyuan Wu, Zijian Zhang, Xianhao Zhang, Meng Li, Yang Liu, Chunmiao Li, et al. 2025. Advanced smart contract vulnerability detection via llm-powered multi-agent systems.IEEE Transactions on Software Engineering(2025)
work page 2025
- [37]
-
[38]
Yin Wu, Xiaofei Xie, Chenyang Peng, Dijun Liu, Hao Wu, Ming Fan, Ting Liu, and Haijun Wang. 2024. Advscanner: Generating adversarial smart contracts to exploit reentrancy vulnerabilities using llm and static analysis. InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering. 1019–1031
work page 2024
-
[39]
Rui Xi, Zehua Wang, and Karthik Pattabiraman. 2024. POMABuster: Detect- ing Price Oracle Manipulation Attacks in Decentralized Finance. In2024 IEEE Symposium on Security and Privacy (SP). IEEE, 3923–3942
work page 2024
-
[40]
Chang Xu, Huaiyu Xu, Liehuang Zhu, Xiaodong Shen, and Kashif Sharif. 2025. Enhanced Smart Contract Vulnerability Detection via Graph Neural Networks: Achieving High Accuracy and Efficiency.IEEE Transactions on Software Engineer- ing(2025)
work page 2025
-
[41]
Yinxing Xue, Mingliang Ma, Yun Lin, Yulei Sui, Jiaming Ye, and Tianyong Peng
-
[42]
InProceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering
Cross-contract static analysis for detecting practical reentrancy vulner- abilities in smart contracts. InProceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering. 1029–1040
- [43]
- [44]
-
[45]
Zhuo Zhang, Brian Zhang, Wen Xu, and Zhiqiang Lin. 2023. Demystifying ex- ploitable bugs in smart contracts. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 615–627
work page 2023
-
[46]
Zibin Zheng, Jianzhong Su, Jiachi Chen, David Lo, Zhijie Zhong, and Mingxi Ye
-
[47]
Dappscan: building large-scale datasets for smart contract weaknesses in dapp projects.IEEE Transactions on Software Engineering50, 6 (2024), 1360–1373
work page 2024
-
[48]
Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. 2023. Sok: Decentralized finance (defi) attacks. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2444–2461
work page 2023
-
[49]
Yaling Zhu, Jia Zeng, Fangchen Weng, Dan Han, Yiyu Yang, Xiaoqi Li, and Yuqing Zhang. 2024. Sybil attacks detection and traceability mechanism based on beacon packets in connected automobile vehicles.Sensors24, 7 (2024), 2153
work page 2024
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.