Pith. sign in

REVIEW 5 major objections 5 minor 80 references

Smart-LLaMA-DPO: Reinforced Large Language Model for Explainable Smart Contract Vulnerability Detection

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single 8-billion-parameter language model, trained with continual pre-training, supervised fine-tuning, and direct preference optimization, outperforms all prior smart-contract vulnerability detectors and explainers in this benchmark.

desk verdict Solid and useful, but the SOTA margins need independent test-set hygiene before I'd trust them. read the letter →

arxiv 2506.18245 v1 pith:TLUHDFUO submitted 2025-06-23 cs.CR cs.AIcs.SE

Lei Yu , Zhirong Huang , Hang Yuan , Shiqi Cheng , Li Yang , Fengjun Zhang , Chenjie Shen , Jiajia Ma
show 3 more authors
Jingyuan Zhang Junyi Lu Chun Zuo
This is my paper
classification cs.CRcs.AIcs.SE
keywords smartcontractvulnerabilitydetectionlargelanguagemodelsdirectpreferenceoptimizationreentrancytimestampdependenceintegeroverflow/underflowdelegatecallmachine-unauditablevulnerabilities
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that one relatively small language model can be made to beat every earlier smart-contract vulnerability detector while also explaining its decisions. The recipe is a three-stage post-training of LLaMA-3.1-8B: continual pre-training on roughly 186,000 real Ethereum contracts, supervised fine-tuning on a human-verified dataset of labels, explanations, and code locations, and direct preference optimization on pairs of expert-preferred and expert-written suboptimal explanations. On a 3,542-contract evaluation set spanning reentrancy, timestamp dependence, integer overflow/underflow, delegatecall, and seven machine-unauditable vulnerability types (bugs that automated tools miss), the paper reports average gains of 10.43% in F1 and 7.87% in accuracy over the previous best baselines, with the largest gain (25.98% F1) on machine-unauditable vulnerabilities. Human and LLM evaluators also rate the generated explanations more correct, thorough, and clear than those of the baselines. If the claim holds, a single model—not a pipeline of separate detectors and explainers—is enough for practical auditing, and the reason is that preference learning fixes the specific error that remains after earlier training stages: misunderstanding the order of external calls and state changes.

What carries the argument

The load-bearing mechanism is Direct Preference Optimization (DPO): a training objective that raises the probability of an expert-preferred explanation and lowers that of a rejected explanation relative to a frozen reference model, without training a separate reward model. DPO is the third stage after continual pre-training on 186,397 real contracts plus general-domain data (620.56M tokens) and supervised fine-tuning on 7,549 human-verified instances with labels, explanations, and locations (8.90M tokens). The preference pairs (1,442 pairs, 1.98M tokens) carry the critical ordering lesson: preferred reentrancy explanations name the exact checks-effects-interactions sequence, trigger conditions, and attack path, while rejected explanations merely flag the risk or state the update order wrongly. The pairing is what lets the model learn subtle security-critical distinctions that absolute labels cannot express.

What would settle it

Obtain a fresh set of 2020-2024 Etherscan and GitHub contracts with independent expert labels, run the released Smart-LLaMA-DPO weights on them without any cleaning, and compare against iAudit and DMT; if the F1 gaps over the prior best shrink to near zero, or the machine-unauditable gap drops from 25.98% toward 0%, the generalization claim would be refuted.

Watch

Extended reading notes

Core claim

After continual pre-training and supervised fine-tuning, an LLM can be right about whether a contract is vulnerable and still wrong about why: it mixes up execution order, for example claiming that a balance is updated before an external call when the code makes the call first. The paper's central claim is that direct preference optimization on expert-verified high/low quality explanation pairs removes this residual error and, as a side effect, sharpens detection itself. The result is a single LLaMA-3.1-8B model that reports F1 improvements of 7.51%, 1.54%, 11.07%, and 6.06% over the previous best on reentrancy, timestamp dependence, overflow/underflow, and delegatecall, respectively, plus a 25.98% F1 improvement on machine-unauditable vulnerabilities, and positive human ratings (4 or 3) on 81.15% of correctness, 83.88% of thoroughness, and 94.63% of clarity judgments.

Load-bearing premise

The reported margins rest on the assumption that the 3,542-contract test set, which the authors cleaned by removing 'incorrect labels' and drew from the same source pools as the training data, is free of near-duplicate overlap with training code; if that assumption fails, the 10.43% F1 gain would overstate how well the model detects unseen real-world contracts.

Editorial extensions

If this is right

  • A single 8B model can act as both detector and explainer, so auditors no longer need to reconcile labels from one tool with justifications from another.
  • The three-stage recipe transfers to other domain-specific languages such as Bash, SQL, and SysML, because only the training corpus and annotation guidelines need adaptation.
  • Preference data becomes a required ingredient for security-focused LLM benchmarks: the ablation shows DPO, not CPT or SFT, is what removes the residual execution-order errors.
  • Dropping either CPT or DPO costs more than a full retrain of the other: CPT carries overflow/underflow understanding while DPO carries reentrancy and machine-unauditable judgments, so they are complementary rather than interchangeable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct test the paper leaves implicit is to run the released weights on an independently and freshly labeled sample of the same 2020-2024 contract sources, without the authors' label-cleaning step, and see whether the 10.43% F1 margin survives; that would isolate the model's true generalization from the benchmark curation.
  • Because the DPO 'suboptimal' answers were written by the same experts who wrote the preferred answers, the learned preference is bounded by that group's notion of quality; a different audit team could produce different pairs and shift what the model learns.
  • The same pipeline could be applied to other high-stakes code, such as DeFi protocol invariants, cross-chain bridges, or administrative key-management logic, where the ablation suggests DPO weight should be higher for reasoning-heavy bug classes and CPT weight higher for syntax-heavy ones.
  • The model's joint label-plus-explanation output suggests an inexpensive triage tool: contracts flagged vulnerable without a concrete exploit path in the explanation could be routed to human auditors first.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Smart-LLaMA-DPO, a smart contract vulnerability detector and explainer built on LLaMA-3.1-8B. The method combines continual pre-training (CPT) on a large Ethereum source-code corpus, supervised fine-tuning (SFT) on a newly constructed multi-type vulnerability dataset with labels, explanations, and locations, and Direct Preference Optimization (DPO) on expert-constructed preferred/rejected explanation pairs. The authors evaluate on a self-assembled test set of 3,542 contracts covering reentrancy, timestamp dependence, integer overflow/underflow, delegatecall, and seven machine-unauditable vulnerability types, reporting state-of-the-art F1 and accuracy gains over a wide range of baselines (claimed averages of +10.43% F1 and +7.87% accuracy). They also report LLM and human evaluations arguing that their explanations are more correct, thorough, and clear than those of iAudit and other baselines. The paper includes ablation studies, a case study, and promises public code, data, and model weights.

Significance. If the reported results are valid, the paper makes a useful contribution: it is, to my knowledge, the first application of DPO to explainable smart contract vulnerability detection, and it provides a relatively broad dataset covering five vulnerability families including machine-unauditable types. The pipeline (CPT then SFT then DPO) is clearly motivated by a concrete failure mode (execution-order misunderstandings), and the ablations suggest that CPT and DPO contribute differently across vulnerability types. The evaluation is unusually extensive for this area, including many rule-based, neural, and LLM baselines, plus human and LLM explanation ratings. The release of code, data, and weights is a concrete strength. However, the central SOTA claim rests on a self-curated test set whose independence from the training corpora is asserted but not demonstrated, and the explanation-quality evaluation uses the same LLM judge that participated in training-data curation; these issues must be resolved before the quantitative claims can be accepted at face value.

major comments (5)
  1. [Section 4.2 (Dataset)] The independence of the evaluation set from the training corpora is load-bearing for the SOTA claim and is not established. The evaluation set is assembled from the same public pools used for training (Qian et al. [49], Zhang et al. [77], Etherscan, GitHub, blogs, 2020-2024), and the paper asserts 'no overlap between evaluation data and training data' without reporting any exact-match or fuzzy deduplication procedure. Given that the CPT corpus alone contains 186,397 Etherscan contracts and the SFT/DPO corpora include token-level ERC20 reentrancy samples from the same sources, near-duplicate code across the split could plausibly account for a large fraction of the reported margins. I request a concrete deduplication analysis (e.g., token-level Jaccard similarity distributions between evaluation and all training corpora, with a stated threshold) or, preferably, an additional evaluation on an independently held-out third-party benchmark.
  2. [Section 4.2 (Dataset cleaning)] The test-set cleaning step appears coupled to the method. The authors state that they performed 'systematic cleaning to remove incorrect labels (e.g., cases mistakenly labeled as vulnerable where there were no state changes after call.value)'; this criterion is exactly the kind of execution-order judgment the model is trained to make. If the cleaning decisions were informed by the authors' own vulnerability criteria or by model outputs, the ground-truth labels are not independent of the evaluated model. The paper should specify who performed the cleaning, whether it was blind to model predictions, how many contracts were relabeled or removed, and should release the list of removed/relabeled contracts for external audit.
  3. [Tables 2-4] The performance comparisons lack error bars, confidence intervals, or significance tests, which is particularly important for the small positive sets. In Table 4, the CI and AV columns have only 10 vulnerable samples each, and in Table 3 the delegatecall positive set has 76 samples; in such cases the difference between F1 = 84.85% and the runner-up values can be driven by a handful of predictions. I request bootstrap confidence intervals for all metrics and pairwise significance tests (e.g., McNemar or approximate randomization) against the strongest baselines (DMT, PSCVFinder, iAudit) on the same test sets.
  4. [Sections 3.2.2 and 3.6.2] The explanation-quality claim is weakened by using the same judge model (Llama-3.1-70B-Instruct) both to select high-scoring explanations for the training dataset and to grade the final explanations of Smart-LLaMA-DPO versus baselines. The agreement validation of this judge was performed on only 40 samples. Although the detection claim is not directly affected by this circularity, the RQ4 claim about explanation superiority needs an independent judge model or a human-only evaluation on a larger sample, together with inter-annotator agreement statistics.
  5. [Section 3 and Tables 2-4] The paper omits Smart-LLaMA (Yu et al., reference [73]), the authors' own two-stage post-trained model and the closest methodological competitor, from all quantitative comparisons. Since the paper explicitly positions Smart-LLaMA-DPO as an advance over Smart-LLaMA, the missing baseline makes the stated 'state-of-the-art' claim incomplete. I request that Smart-LLaMA be evaluated on the same test set (using the released weights if available) or that a clear justification for its exclusion be provided.
minor comments (5)
  1. [Abstract and Section 2] Typos: 'Futhermore' and 'ultilizing' should be corrected; the term 'machine-unauditable' should be defined at first use in the abstract or introduction.
  2. [Figures 1 and 2] Figure 1 is hard to read as rendered: the code and explanation boxes are cramped, and the arrow labels inside the boxes are not typeset cleanly. Figure 2 would benefit from a clearer separation of the data-construction and training flows.
  3. [Section 4.2, Table 4] The introduction claims an F1 improvement of 25.98% over iAudit for machine-unauditable vulnerabilities, but Table 4 reports Ours Total F1 = 83.4% versus iAudit Total F1 = 66.2%, which is a difference of 17.2 percentage points, not 25.98%. Please reconcile the numbers and the exact baseline used.
  4. [Section 3.3, Eq. (1)] Equation (1) is typeset as a running fraction with the summation index over n but no explicit upper bound; please reformat so that the token-level CE loss is unambiguous.
  5. [Section 6] The internal-validity discussion notes that the model sometimes produces redundant output and that truncation is used as a post-processing step. Please specify the truncation rule and its effect on the reported explanation-quality scores, since the human and LLM raters evaluated the truncated outputs.

Circularity Check

1 steps flagged · score 4.0 of 10

Detection claim is grounded in external labels and a standard DPO objective, but the explanation-quality evaluation is partially circular: the same Llama-3.1-70B judge used to select training explanations also grades the final outputs.

  1. other [Sections 3.2.2, 3.6.2, RQ4 (Table 6)]
    "We employed Llama-3.1-70B-Instruct (validated in Section 3.6.2) as an evaluation model to assess explanations from Qwen2.5 and Mistral ... Explanations with the highest weighted composite scores ... were selected for human review. ... We employed Llama-3.1-70B-Instruct for automated assessment, selected after comparing multiple LLMs on 40 explanation samples (8 per vulnerability type)."

    The same model, using the same three criteria (correctness, thoroughness, clarity), first scored candidate explanations and chose which outputs entered the SFT pool and, after human refinement, the preferred side of DPO pairs. It is then reused as the automated grader in RQ4/Table 6. The 'LLM evaluation' column therefore measures agreement with the judge's own earlier selection signal more than an external quality standard. The 40-sample human-agreement calibration is too small and too upstream to break the loop; it certifies the judge on samples not produced by the final model. This inflates the LLM-evaluation part of the explanation claim, though the human evaluation and detection metrics are not derived from this loop.

full rationale

The detection results (RQ1, RQ2) are not circular in the equation sense: Eq. (8) is the standard DPO loss from Rafailov et al. (external, machine-checkable in the literature), the SFT/CPT losses are ordinary language-modeling objectives, and the vulnerability labels are external audit reports, SmartBugs-derived annotations, and Code4rena findings rather than outputs of the proposed model. The SOTA improvements do not reduce to the paper's own equations by construction. The main partial circularity is confined to explanation-quality assessment: Llama-3.1-70B-Instruct is used both to select/rank training explanations (Section 3.2.2) and to grade the final explanations (Section 3.6.2, Table 6), making that portion of RQ4 a self-consistency check. The paper's citation of the authors' own Smart-LLaMA [73] and PSCVFinder [74] for the data-generation recipe is not load-bearing—the recipe is re-described here and no uniqueness/forbidden-alternative argument rests on those citations. Separately, this is a validity risk rather than a formal circularity: Section 4.2 says the evaluation set was assembled from the same public pools used for training and 'performed systematic cleaning to remove incorrect labels,' with only an assertion of no overlap and no reported deduplication, so a reproducibility-sensitive reader should treat the exact 10.43%/7.87% margins cautiously. Those concerns lower confidence in the headline numbers but do not make the detection derivation circular.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new physical, mathematical, or ontological entities are introduced. The trained model and dataset are artifacts, not postulates with independent falsifiable handles. The central empirical claim rests on the validity of the DPO objective, the correctness of expert annotations, and the cleanliness of the evaluation split.

free parameters (3)
  • DPO temperature beta = not reported
    Appears in the DPO loss (Eq. 8) and controls preference strength; no value is given in Section 4.5, so replication requires guessing it.
  • WCS weights for explanation scoring = Correctness 0.6, thoroughness 0.3, clarity 0.1
    Hand-chosen in Section 3.2.2; these weights determine which LLM-generated explanations survive to human review and therefore shape the training data.
  • CPT token-similarity threshold = 0.9
    Used in Section 3.1.1 to deduplicate the continual pre-training corpus; affects domain adaptation and is a design choice inherited from prior work.
assumptions (4)
  • domain assumption The DPO/Bradley-Terry reward formulation (Eqs. 5-8) is an appropriate model of expert preference for vulnerability explanations.
    Section 3.5 invokes Rafailov et al. [51]; the paper does not test whether this preference model fits human judgments in this domain.
  • domain assumption Labels in the training datasets from Liu et al. [33], Yu et al. [74], and Zhang et al. [77], plus expert corrections, are correct ground truth.
    Sections 3.1.2 and 3.2.3 rely on these annotations without quantitative verification of annotation quality.
  • domain assumption The evaluation set is clean and does not overlap with training/DPO data, despite sharing source pools.
    Section 4.2 states no overlap but does not report a near-duplicate analysis; the authors also removed label errors after collection.
  • domain assumption The seven 'machine-unauditable' vulnerability categories from Zhang et al. [77] form a valid taxonomy and their Code4rena-derived labels are reliable.
    Section 2.2 defines MU categories; the model is trained and evaluated on these categories.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Smart-LLaMA-DPO: Reinforced Large Language Model for Explainable Smart Contract Vulnerability Detection." pith.science (2026). https://pith.science/paper/TLUHDFUO

@misc{pith2026250618245,
  author       = {Pith},
  title        = {Pith review of: Smart-LLaMA-DPO: Reinforced Large Language Model for Explainable Smart Contract Vulnerability Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TLUHDFUO}},
  note         = {Machine review of arXiv:2506.18245}
}
read the original abstract

Smart contract vulnerability detection remains a major challenge in blockchain security. Existing vulnerability detection methods face two main issues: (1) Existing datasets lack comprehensive coverage and high-quality explanations for preference learning. (2) Large language models (LLMs) often struggle with accurately interpreting specific concepts in smart contract security. Empirical analysis shows that even after continual pre-training (CPT) and supervised fine-tuning (SFT), LLMs may misinterpret the execution order of state changes, resulting in incorrect explanations despite making correct detection decisions. To address these challenges, we propose Smart-LLaMA-DPO based on LLaMA-3.1-8B. We construct a comprehensive dataset covering four major vulnerability types and machine-unauditable vulnerabilities, including precise labels, explanations, and locations for SFT, as well as high-quality and low-quality output pairs for Direct Preference Optimization (DPO). Second, we perform CPT using large-scale smart contract to enhance the LLM's understanding of specific security practices in smart contracts. Futhermore, we conduct SFT with our comprehensive dataset. Finally, we apply DPO, leveraging human feedback and a specially designed loss function that increases the probability of preferred explanations while reducing the likelihood of non-preferred outputs. We evaluate Smart-LLaMA-DPO on four major vulnerability types: reentrancy, timestamp dependence, integer overflow/underflow, and delegatecall, as well as machine-unauditable vulnerabilities. Our method significantly outperforms state-of-the-art baselines, with average improvements of 10.43% in F1 score and 7.87% in accuracy. Moreover, both LLM evaluation and human evaluation confirm that our method generates more correct, thorough, and clear explanations.

Figures

Figures reproduced from arXiv: 2506.18245 by the authors.

Figure 1
Figure 1. An motivation example to illustrate the limitations of LLM-based Explainable Smart Contract Vulnera [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. The Overview of our Smart-LLaMA-DPO. 3.3 Continual Pre-Training In the Continual Pre-Training phase, we focus on enhancing the LLM’s comprehension of smart contract security. This process is guided by a domain-specific language modeling objective: 𝐿𝐶𝑃𝑇 = −E𝑥 ∼ 𝐷[ ∑︁ 𝑖 = 1 𝑛 log 𝑃 (𝑥𝑖 |𝑥<𝑖 , 𝑐𝑖)] (1) Here, 𝐷 represents our curated dataset of smart contracts, 𝑥 is a sequence of tokens from a contract, 𝑐𝑖 denotes the c… view at source ↗
Figure 3
Figure 3. Case Study of Smart Contract Vulnerability Detection Using Smart-LLaMA-DPO. [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

80 extracted references · 50 canonical work pages

  1. [49]

    Peng Qian, Zhenguang Liu, Yifang Yin, and Qinming He. 2023. Cross-modality mutual learning for enhancing smart contract vulnerability detection on bytecode. InProceedings of the ACM Web Conference 2023. 2220–2229

    work page 2023

  2. [77]

    Zhuo Zhang, Brian Zhang, Wen Xu, and Zhiqiang Lin. 2023. Demystifying exploitable bugs in smart contracts. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 615–627

    2023

  3. [73]

    Lei Yu, Shiqi Chen, Hang Yuan, Peng Wang, Zhirong Huang, Jingyuan Zhang, Chenjie Shen, Fengjun Zhang, Li Yang, and Jiajia Ma. 2024. Smart-LLaMA: Two-Stage Post-Training of Large Language Models for Smart Contract Vulnerability Detection and Explanation.arXiv preprint arXiv:2411.06221(2024)

    arXiv 2024

  4. [1]

    models of Smart-LLaMA-DPO

    2025. models of Smart-LLaMA-DPO. https://doi.org/10.5281/zenodo.15255329

    work page doi:10.5281/zenodo.15255329 2025

  5. [2]

    Smart-LLaMA-DPO

    2025. Smart-LLaMA-DPO. https://gitlab.com/programmer-of-nansijie/smart-llama-dpo

    work page 2025

  6. [3]

    Amr Abo-eleneen, Ahammed Palliyali, and Cagatay Catal. 2023. The role of Reinforcement Learning in software testing.Information and Software Technology(2023), 107325

    work page 2023

  7. [4]

    Maher Alharby and Aad Van Moorsel. 2017. Blockchain-based smart contracts: A systematic mapping study.arXiv preprint arXiv:1710.06372(2017)

    arXiv 2017

  8. [5]

    Miltiadis Allamanis. 2019. The adverse effects of code duplication in machine learning models of code. InProceedings of the 2019 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Software. 143–153

    work page 2019

Show all 80 references
  1. [6]

    Kamel Alrashedy and Ahmed Binjahlan. 2023. Language Models are Better Bug Detector Through Code-Pair Classifi- cation.arXiv preprint arXiv:2311.07957(2023)

    2023 arXiv

  2. [7]

    Anthropic. 2024. Claude-3.5-Sonnet. https://www.anthropic.com/claude

    2024

  3. [8]

    The Solidity Authors. 2024. Solidity Documentation. https://docs.soliditylang.org/en/v0.8.28/ Online documentation

    2024

  4. [9]

    Priyanka Bose, Dipanjan Das, Yanju Chen, Yu Feng, Christopher Kruegel, and Giovanni Vigna. 2022. Sailfish: Vetting smart contract state-inconsistency bugs in seconds. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 161–178

    2022

  5. [10]

    Partha Chakraborty, Mahmoud Alfadel, and Meiyappan Nagappan. 2024. RLocator: Reinforcement learning for bug localization.IEEE Transactions on Software Engineering(2024)

    2024

  6. [11]

    Chong Chen, Jianzhong Su, Jiachi Chen, Yanlin Wang, Tingting Bi, Yanli Wang, Xingwei Lin, Ting Chen, and Zibin Zheng. 2023. When chatgpt meets smart contract vulnerability detection: How far are we?arXiv preprint arXiv:2309.05520(2023)

    2023 arXiv

  7. [12]

    Huashan Chen, Marcus Pendleton, Laurent Njilla, and Shouhuai Xu. 2020. A survey on ethereum systems security: Vulnerabilities, attacks, and defenses.ACM Computing Surveys (CSUR)53, 3 (2020), 1–43

    2020

  8. [13]

    Jaeseung Choi, Doyeon Kim, Soomin Kim, Gustavo Grieco, Alex Groce, and Sang Kil Cha. 2021. Smartian: Enhancing smart contract fuzzing with static and dynamic data-flow analyses. In2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 227–239

    2021

  9. [14]

    Davide Corradini, Zeno Montolli, Michele Pasqua, and Mariano Ceccato. 2024. DeepREST: Automated Test Case Generation for REST APIs Exploiting Deep Reinforcement Learning.arXiv preprint arXiv:2408.08594(2024)

    2024 arXiv

  10. [15]

    Isaac David, Liyi Zhou, Kaihua Qin, Dawn Song, Lorenzo Cavallaro, and Arthur Gervais. 2023. Do you still need a manual smart contract audit?arXiv preprint arXiv:2306.12338(2023)

    2023 arXiv

  11. [16]

    Vikram Dhillon, David Metcalf, Max Hooper, Vikram Dhillon, David Metcalf, and Max Hooper. 2017. The DAO hacked. blockchain enabled applications: Understand the blockchain Ecosystem and How to Make it work for you(2017), 67–78

    2017

  12. [17]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models.arXiv preprint arXiv:2407.21783 (2024)

    2024 arXiv

  13. [18]

    Ethereum Foundation. 2024. Block and Transaction Properties. https://docs.soliditylang.org/en/latest/units-and-global- variables.html#block-and-transaction-properties

    2024

  14. [19]

    Ethereum Foundation. 2024. Security Considerations - Sending and Receiving Ether. https://docs.soliditylang.org/en/ latest/security-considerations.html#sending-and-receiving-ether

    2024

  15. [20]

    Ethereum Foundation. 2024. Solidity by Example - Delegatecall. https://solidity-by-example.org/delegatecall/

    2024

  16. [21]

    Josselin Feist, Gustavo Grieco, and Alex Groce. 2019. Slither: a static analysis framework for smart contracts. In2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB). IEEE, 8–15

    2019

  17. [22]

    João F Ferreira, Pedro Cruz, Thomas Durieux, and Rui Abreu. 2020. Smartbugs: A framework to analyze solidity smart contracts. InProceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering. 1349–1352

    2020

  18. [23]

    Jianbo Gao, Han Liu, Chao Liu, Qingshan Li, Zhi Guan, and Zhong Chen. 2019. Easyflow: Keep ethereum away from overflow. In2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). IEEE, 23–26

    2019

  19. [24]

    Zhipeng Gao, Vinoj Jayasundara, Lingxiao Jiang, Xin Xia, David Lo, and John Grundy. 2019. Smartembed: A tool for clone and bug detection in smart contracts through structural code embedding. In2019 IEEE International Conference on Software Maintenance and Evolution (ICSME). IE...

    2019

  20. [25]

    Péter Hegedűs. 2018. Towards analyzing the complexity landscape of solidity based ethereum smart contracts. In Proceedings of the 1st International Workshop on Emerging Trends in Software Engineering for Blockchain. 35–39

    2018

  21. [26]

    Tharaka Hewa, Mika Ylianttila, and Madhusanka Liyanage. 2021. Survey on blockchain based smart contracts: Applications, opportunities and challenges.Journal of Network and Computer Applications177 (2021), 102857

    2021

  22. [27]

    Sihao Hu, Tiansheng Huang, Fatih İlhan, Selim Furkan Tekin, and Ling Liu. 2023. Large language model-powered smart contract vulnerability detection: New perspectives.arXiv preprint arXiv:2310.01152(2023). Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA009. Publication ...

    2023 arXiv

  23. [28]

    Ankur Joshi, Saket Kale, Satish Chandel, and D Kumar Pal. 2015. Likert scale: Explored and explained.British journal of applied science & technology7, 4 (2015), 396–403

    2015

  24. [29]

    Myeongsoo Kim, Saurabh Sinha, and Alessandro Orso. 2023. Adaptive rest api testing with reinforcement learning. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 446–458

    2023

  25. [30]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks.arXiv preprint arXiv:1609.02907(2016)

    2016 arXiv

  26. [31]

    Bolun Li, Zhihong Sun, Tao Huang, Hongyu Zhang, Yao Wan, Ge Li, Zhi Jin, and Chen Lyu. 2024. IRCoCo: Immediate Rewards-Guided Deep Reinforcement Learning for Code Completion.Proceedings of the ACM on Software Engineering 1, FSE (2024), 182–203

    2024

  27. [32]

    Zhenguang Liu, Peng Qian, Xiang Wang, Lei Zhu, Qinming He, and Shouling Ji. 2021. Smart contract vulnerabil- ity detection: from pure neural network to interpretable graph feature and expert pattern fusion.arXiv preprint arXiv:2106.09282(2021)

    2021 arXiv

  28. [33]

    Zhenguang Liu, Peng Qian, Jiaxu Yang, Lingfeng Liu, Xiaojun Xu, Qinming He, and Xiaosong Zhang. 2023. Rethinking smart contract fuzzing: Fuzzing with invocation ordering and important branch revisiting.IEEE Transactions on Information Forensics and Security18 (2023), 1237–1251

    2023

  29. [34]

    Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization.arXiv preprint arXiv:1711.05101(2017)

    2017 arXiv

  30. [35]

    Junyi Lu, Lei Yu, Xiaojia Li, Li Yang, and Chun Zuo. 2023. Llama-reviewer: Advancing code review automation with large language models through parameter-efficient fine-tuning. In2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE). IEEE, 647–658

    2023

  31. [36]

    Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena, and Aquinas Hobor. 2016. Making smart contracts smarter. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 254–269

    2016

  32. [37]

    Wei Ma, Daoyuan Wu, Yuqiang Sun, Tianwen Wang, Shangqing Liu, Jian Zhang, Yue Xue, and Yang Liu. 2024. Combining Fine-Tuning and LLM-based Agents for Intuitive Smart Contract Auditing with Justifications.arXiv preprint arXiv:2403.16073(2024)

    2024 arXiv

  33. [38]

    Muhammad Izhar Mehar, Charles Louis Shier, Alana Giambattista, Elgar Gong, Gabrielle Fletcher, Ryan Sanayhie, Henry M Kim, and Marek Laskowski. 2019. Understanding a revolutionary and flawed grand experiment in blockchain: the DAO attack.Journal of Cases on Information Technol...

    2019

  34. [39]

    Mistral. 2024. Large Enough | Mistral AI | Frontier AI in your hands. https://mistral.ai/news/mistral-large-2407/

    2024

  35. [40]

    B Mueller. 2017. Mythril-Reversing and bug hunting framework for the Ethereum blockchain

    2017

  36. [41]

    Mona Nashaat and James Miller. 2024. Towards Efficient Fine-tuning of Language Models with Organizational Data for Automated Software Review.IEEE Transactions on Software Engineering(2024)

    2024

  37. [42]

    Tai D Nguyen, Long H Pham, Jun Sun, Yun Lin, and Quang Tran Minh. 2020. sfuzz: An efficient adaptive fuzzer for solidity smart contracts. InProceedings of the ACM/IEEE 42nd International Conference on Software Engineering. 778–788

    2020

  38. [43]

    Amin Nikanjam, Mohammad Mehdi Morovati, Foutse Khomh, and Houssem Ben Braiek. 2022. Faults in deep reinforcement learning programs: a taxonomy and a detection approach.Automated software engineering29, 1 (2022), 8

    2022

  39. [44]

    OpenAI. 2024. GPT-4-Turbo. https://platform.openai.com/docs/models/gpt-4-and-gpt-4-turbo

    2024

  40. [45]

    OWASP Foundation. 2023. OWASP Smart Contract Top 10. https://owasp.org/www-project-smart-contract-top-10/. Accessed: 2024-12-04

    2023

  41. [46]

    Purathani Praitheeshan, Lei Pan, Jiangshan Yu, Joseph Liu, and Robin Doss. 2019. Security analysis methods on ethereum smart contract vulnerabilities: a survey.arXiv preprint arXiv:1908.08605(2019)

    2019 arXiv

  42. [47]

    Protofire. 2020. Solhint: A linting utility for Solidity code. https://github.com/protofire/solhint. GitHub repository with over 1000 stars, Used by over 54,000 repositories

    2020

  43. [48]

    Peng Qian, Zhenguang Liu, Qinming He, Roger Zimmermann, and Xun Wang. 2020. Towards automated reentrancy detection for smart contracts based on sequential models.IEEE Access8 (2020), 19685–19695

    2020

  44. [50]

    Qwen. 2024. Qwen2.5: A Party of Foundation Models. https://qwenlm.github.io/blog/qwen2.5/

    2024

  45. [51]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model.Advances in Neural Information Processing Systems36 (2023), 53728–53741

    2023

  46. [52]

    Jeff Rasley, Samyam Rajbhandari, Olatunji Ruwase, and Yuxiong He. 2020. Deepspeed: System optimizations enable training deep learning models with over 100 billion parameters. InProceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. 3505–3506

    2020

  47. [53]

    Sameer Reddy, Caroline Lemieux, Rohan Padhye, and Koushik Sen. 2020. Quickly generating diverse valid test inputs with reinforcement learning. InProceedings of the ACM/IEEE 42nd International Conference on Software Engineering. Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article...

    2020

  48. [54]

    Andrea Romdhana, Alessio Merlo, Mariano Ceccato, and Paolo Tonella. 2022. Deep reinforcement learning for black-box testing of android apps.ACM Transactions on Software Engineering and Methodology (TOSEM)31, 4 (2022), 1–29

    2022

  49. [55]

    André Storhaug, Jingyue Li, and Tianyuan Hu. 2023. Efficient avoidance of vulnerabilities in auto-completed smart contract code using vulnerability-constrained decoding. In2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE). IEEE, 683–693

    2023

  50. [56]

    Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Wei Ma, Lyuye Zhang, Yang Liu, and Yingjiu Li. 2024. Llm4vuln: A unified evaluation framework for decoupling and enhancing llms’ vulnerability reasoning.arXiv preprint arXiv:2401.16185 (2024)

    2024 arXiv

  51. [57]

    Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Haijun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. 2024. GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis.Proc. IEEE/ACM ICSE (2024)

    2024

  52. [58]

    O’Reilly Media, Inc

    Melanie Swan. 2015.Blockchain: Blueprint for a new economy. " O’Reilly Media, Inc. "

    2015

  53. [59]

    Sergei Tikhomirov, Ekaterina Voskresenskaya, Ivan Ivanitskiy, Ramil Takhaviev, Evgeny Marchenko, and Yaroslav Alexandrov. 2018. Smartcheck: Static analysis of ethereum smart contracts. InProceedings of the 1st International Workshop on Emerging Trends in Software Engineering f...

    2018

  54. [60]

    Christof Ferreira Torres, Antonio Ken Iannillo, Arthur Gervais, and Radu State. 2021. Confuzzius: A data dependency- aware hybrid fuzzer for smart contracts. In2021 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 103–119

    2021

  55. [61]

    Christof Ferreira Torres, Julian Schütte, and Radu State. 2018. Osiris: Hunting for integer bugs in ethereum smart contracts. InProceedings of the 34th Annual Computer Security Applications Conference. 664–676

    2018

  56. [62]

    Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Buenzli, and Martin Vechev. 2018. Securify: Practical security analysis of smart contracts. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. 67–82

    2018

  57. [63]

    Nuno Veloso. 2021. Conkas. https://github.com/nveloso/conkas. GitHub repository

    2021

  58. [64]

    Chong Wang, Yiling Lou, Junwei Liu, and Xin Peng. 2023. Generating variable explanations via zero-shot prompt learning. In2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 748–760

    2023

  59. [65]

    Pengcheng Wang, Jeffrey Svajlenko, Yanzhao Wu, Yun Xu, and Chanchal K Roy. 2018. CCAligner: a token based large-gap clone detector. InProceedings of the 40th International Conference on Software Engineering. 1066–1077

    2018

  60. [66]

    Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. 2022. Self-consistency improves chain of thought reasoning in language models.arXiv preprint arXiv:2203.11171 (2022)

    2022 arXiv

  61. [67]

    Yue Wang, Weishi Wang, Shafiq Joty, and Steven CH Hoi. 2021. CodeT5: Identifier-aware Unified Pre-trained Encoder- Decoder Models for Code Understanding and Generation. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 8696–8708

    2021

  62. [68]

    Yanlin Wang, Yanli Wang, Daya Guo, Jiachi Chen, Ruikai Zhang, Yuchi Ma, and Zibin Zheng. 2024. Rlcoder: Reinforce- ment learning for repository-level code completion.arXiv preprint arXiv:2407.19487(2024)

    2024 arXiv

  63. [69]

    Zhiyuan Wei, Jing Sun, Zijian Zhang, Xianhao Zhang, and Meng Li. 2024. Leveraging Fine-Tuned Language Models for Efficient and Accurate Smart Contract Auditing.arXiv preprint arXiv:2410.13918(2024)

    2024

  64. [70]

    Gavin Wood et al. 2014. Ethereum: A secure decentralised generalised transaction ledger.Ethereum project yellow paper151, 2014 (2014), 1–32

    2014

  65. [71]

    Hongjun Wu, Zhuo Zhang, Shangwen Wang, Yan Lei, Bo Lin, Yihao Qin, Haoyu Zhang, and Xiaoguang Mao. 2021. Peculiar: Smart contract vulnerability detection based on crucial data flow graph and pre-training techniques. In2021 IEEE 32nd International Symposium on Software Reliabil...

    2021

  66. [72]

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, et al. 2024. Qwen2 technical report.arXiv preprint arXiv:2407.10671(2024)

    2024 arXiv

  67. [74]

    Lei Yu, Junyi Lu, Xianglong Liu, Li Yang, Fengjun Zhang, and Jiajia Ma. 2023. PSCVFinder: A Prompt-Tuning Based Framework for Smart Contract Vulnerability Detection. In2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE). IEEE, 556–567

    2023

  68. [75]

    Lei Yu, Fengjun Zhang, Jiajia Ma, Li Yang, Yuanzhe Yang, and Wei Jia. 2023. Who Are the Money Launderers? Money Laundering Detection on Blockchain via Mutual Learning-Based Graph Neural Network. In2023 International Joint Conference on Neural Networks (IJCNN). IEEE, 1–8. Proc....

    2023

  69. [76]

    Quanjun Zhang, Tongke Zhang, Juan Zhai, Chunrong Fang, Bowen Yu, Weisong Sun, and Zhenyu Chen. 2023. A critical review of large language model on software engineering: An example from chatgpt and automated program repair.arXiv preprint arXiv:2310.08879(2023)

    2023 arXiv

  70. [78]

    Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, and Zheyan Luo. 2024. Llamafactory: Unified efficient fine-tuning of 100+ language models.arXiv preprint arXiv:2403.13372(2024)

    2024 arXiv

  71. [79]

    Yuan Zhuang, Zhenguang Liu, Peng Qian, Qi Liu, Xiang Wang, and Qinming He. 2020. Smart Contract Vulnerability Detection using Graph Neural Network.. InIJCAI. 3283–3290

    2020

  72. [80]

    Weiqin Zou, David Lo, Pavneet Singh Kochhar, Xuan-Bach Dinh Le, Xin Xia, Yang Feng, Zhenyu Chen, and Baowen Xu. 2019. Smart contract development: Challenges and opportunities.IEEE Transactions on Software Engineering47, 10 (2019), 2084–2106. Received 2024-10-31; accepted 2025-...

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.