TL;DR
ContractTinker leverages large language models and static analysis to effectively repair real-world smart contract vulnerabilities, addressing limitations of pattern-based tools with high semantic understanding.
Contribution
The paper introduces ContractTinker, a novel LLM-powered tool that uses Chain-of-Thought reasoning and static analysis to improve vulnerability repair in smart contracts.
Findings
48% of generated patches are valid fixes
21% of patches need minor modifications
Effective on 48 high-risk vulnerabilities
Abstract
Smart contracts are susceptible to being exploited by attackers, especially when facing real-world vulnerabilities. To mitigate this risk, developers often rely on third-party audit services to identify potential vulnerabilities before project deployment. Nevertheless, repairing the identified vulnerabilities is still complex and labor-intensive, particularly for developers lacking security expertise. Moreover, existing pattern-based repair tools mostly fail to address real-world vulnerabilities due to their lack of high-level semantic understanding. To fill this gap, we propose ContractTinker, a Large Language Models (LLMs)-empowered tool for real-world vulnerability repair. The key insight is our adoption of the Chain-of-Thought approach to break down the entire generation task into sub-tasks. Additionally, to reduce hallucination, we integrate program static analysis to guide the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
