Framework improves smart contract security tasks by changing protocols
Beyond Copying: Lifelong Smart Contract Security Task Construction via Protocol Mutation
Cryptography and SecurityArtificial Intelligence
Summary
Smart contracts are computer programs that run on blockchains, but they often have security problems that can cause big financial losses. The authors created CONSTRAINTDIAL, a system that automatically changes (or mutates) contract interactions to build new security tests that can't be solved by just copying known answers. This helps create many different tasks to better check if smart contracts are secure, making it harder for attackers to exploit known weaknesses.
What this means in practice
- •For blockchain security teams: Automatically generate evolving smart contract security tests that resist copying of known attacks.
- •For software audit firms: Use automated protocol mutation to create diverse security audit tasks, reducing manual effort in vulnerability validation.
Authors
Zifan Peng, Peng Huang, Jingyi Zheng, Yingjie Xue, Xuechao Wang, Xinlei He, Xia Hu, Dongrui Liu
Abstract
AI agents can inspect code and run tests to support smart contract security. SlowMist reports about $38.6 billion in losses across the broader blockchain ecosystem. Existing evaluations can reward memorized or copied answers, including attack code recovered from public blockchain transactions. Reconstructing contracts and validating tasks also require costly manual effort. To address these issues, we propose CONSTRAINTDIAL, a framework for lifelong construction of smart contract security tasks via protocol mutation. It automates local contract reconstruction and uses attack execution to select changes to the required calls or inputs. Execution checks guide revisions that make the original attack fail while preserving exploitability, the security objective, and normal functionality. New incidents and audit findings enter the same procedure. With CONSTRAINTDIAL, we construct 3,045 task inputs from 203 public cases, covering detect, exploit, and patch. Compared with reconstruction alone, protocol mutation reduces success with supplied public answers by 10.9 percentage points on average across detect, exploit, and patch. The fraction of tasks solved by copying online answers falls by 9.3 points.