NeuroSCA: Neuro-Symbolic Constraint Abstraction for Smart Contract Hybrid Fuzzing

TL;DR

NeuroSCA enhances hybrid fuzzing for smart contracts by integrating an LLM-based semantic abstraction layer, improving efficiency and bug detection in complex real-world contracts without sacrificing performance on simpler cases.

Contribution

It introduces NeuroSCA, a novel framework that uses an LLM to selectively abstract constraints, reducing pollution and improving fuzzing effectiveness for smart contract vulnerability discovery.

Findings

Speeds up solving on polluted paths

Increases coverage and bug-finding rates

Maintains efficiency on easy contracts

Abstract

Hybrid fuzzing combines greybox fuzzing's throughput with the precision of symbolic execution to uncover deep smart contract vulnerabilities. However, its effectiveness is often limited by constraint pollution: in real world contracts, path conditions pick up semantic noise from global state and defensive checks that are syntactically intertwined with, but semantically peripheral to, the target branch, causing SMT timeouts. We propose NeuroSCA (Neuro-Symbolic Constraint Abstraction), a lightweight framework that selectively inserts a Large Language Model (LLM) as a semantic constraint abstraction layer. NeuroSCA uses the LLM to identify a small core of goal-relevant constraints, solves only this abstraction with an SMT solver, and validates models via concrete execution in a verifier-in-the-loop refinement mechanism that reintroduces any missed constraints and preserves soundness. Experiments on real-world contracts show that NeuroSCA speeds up solving on polluted paths, increases coverage and bug-finding rates on representative hard contracts, and, through its selective invocation policy, achieves these gains with only modest overhead and no loss of effectiveness on easy contracts.