When Verified Source Becomes Attack Input: Defending Smart Contracts Against LLM-Based Vulnerability Scanning
Cryptography and SecuritySoftware Engineering
Summary
The authors study how smart contract source code, usually made public to build trust, can now be scanned for vulnerabilities by powerful language models (LLMs), raising security concerns. They propose DeLLMGuard, a system that keeps source code public but splits it across multiple contract addresses to confuse LLM-based scanners. DeLLMGuard also includes a verification step to ensure the contract behaves as intended despite these changes. Their tests show this method reduces the chances that LLMs find the actual vulnerabilities, though fully analyzing linked contracts remains difficult for automated tools.
Authors
Mingyuan Huang, Zimo Ji, Yifan Mo, Shuai Wang
Abstract
Smart contracts are financial programs deployed on blockchains to manage digital assets. To build trust with users and investors, smart contract projects typically publish their source code on blockchain explorers and verify it against the deployed bytecode, making the on-chain program accessible through a human-readable implementation. However, LLM agents are changing the threat model of this disclosure mechanism. By leveraging publicly disclosed source code, recent agent workflows make it increasingly practical to scan contract vulnerabilities for exploits at large scale. In this paper, we propose DeLLMGuard, a smart contract deployment framework that defends against malicious LLM-based vulnerability scanning while preserving public source disclosure and authorized auditing. DeLLMGuard can separate disclosed source code from runtime execution through multiple contract addresses in a real-world blockchain environment. LLM agents must therefore recover additional proxy, delegate, and factory relations before vulnerability analysis. A built-in Verification Layer checks deployment relations, runtime bytecode, source code, and state changes to ensure that the transformation preserves the original business implementation. We evaluate DeLLMGuard on 387 real-world vulnerable contracts with three LLM agents in an environment derived from SCONE-bench. DeLLMGuard reduces overall root-cause correctness from 23.5% to 6.6% and outperforms the closed-source bytecode baseline on the primary non-proxy set. Trace and ablation analyses further show that agents often recover downstream contracts but still fail to identify the vulnerability, indicating that cross-contract recovery remains a major challenge for automated LLM scanning.