簡易檢索 / 詳目顯示

回結果列表
研究生： 黃家綺
Huang, Chia-Chi
論文名稱： 基於大型語言模型之工作流導向自我改進智能合約漏洞檢測框架
A Workflow-Oriented Self-Improving Framework for Smart Contract Vulnerability Detection with Large Language Models
指導教授： 涂嘉恒
Tu, Chia-Heng
學位類別： 碩士
Master
系所名稱： 電機資訊學院 - 資訊工程學系
Department of Computer Science and Information Engineering
論文出版年： 2026
畢業學年度： 114
語文別： 英文
論文頁數： 77
中文關鍵詞： 智能合約 、漏洞偵測 、大型語言模型
外文關鍵詞： Smart Contract, Vulnerability Detection, Large Language Models
相關次數： 點閱：3  下載：0 
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報

    • 隨著區塊鏈技術快速發展，智能合約已廣泛應用於去中心化金融（DeFi）、NFT 與各類鏈上應用。然而，由於智能合約具有不可竄改與直接管理資產等特性，一旦存在安全漏洞，往往會造成嚴重經濟損失。傳統靜態分析工具雖能檢測部分已知漏洞，但在複雜業務邏輯分析與新型漏洞辨識方面仍存在限制。近年來，大型語言模型（Large Language Models, LLMs）逐漸被應用於智能合約安全分析，但現有研究多半直接將原始程式碼輸入模型進行漏洞檢測，缺乏完整的工作流程設計與自我改進能力。
    為了解決上述問題，本研究提出一套基於大型語言模型之工作流導向自我改進智能合約漏洞檢測框架。系統透過細粒度任務拆分與業務流程分析提升模型對風險場景的理解能力，並採用多模型協作機制以提升分析穩定性與準確性。此外，系統導入自我改進機制，透過錯誤分析、自動化檢查清單更新與知識庫最佳化，降低人工規則維護成本。
    本研究亦設計目標導向的知識檢索機制，以降低無關資訊對模型推理的干擾。實驗結果顯示，即使使用成本較低的主流大型語言模型，所提出的方法仍能有效提升智能合約漏洞檢測能力與分析穩定性，展現良好的可擴展性與實務應用潛力。

    With the rapid development of blockchain technology, smart contracts have been widely adopted in decentralized finance (DeFi), NFTs, and various on-chain applications. However, traditional static analysis tools still face limitations in complex business-logic analysis and novel vulnerability detection, while existing LLM-based approaches often lack structured workflows and self-improvement mechanisms.
    To address these issues, this study proposes a workflow-oriented self-improving framework for smart contract vulnerability detection using Large Language Models (LLMs). The framework adopts fine-grained task decomposition, business-flow analysis, multi-model collaboration, and automated checklist refinement to improve analysis accuracy and stability while reducing manual rule maintenance costs.
    Experimental results show that the proposed framework can effectively improve vulnerability detection capability and analysis stability even when using cost-efficient mainstream LLMs, demonstrating strong scalability and practical applicability.

    中文摘要 i Abstract ii Acknowledgements iii Contents iv List of Tables vii List of Figures ix 1 Introduction 1 2 Background and Related Works 3 2.1 Smart Contract Audit Workflow 3 2.2 Traditional Analysis Tools and Vulnerability Categories 5 2.3 Large Language Models and Agentic Systems 6 2.3.1 Large Language Models 6 2.3.2 LLM Agents and Multi-Agent Collaboration 7 2.4 LLM-Based Smart Contract Vulnerability Detection 8 2.5 Summary 11 3 Proposed Scheme 13 3.1 Overview of the Proposed Framework 13 3.2 Workflow Execution Process 15 3.3 Task Specification Generation 16 3.3.1 Human-Auditing-Inspired Task Decomposition 16 3.3.2 Meta-Prompt-Based Workflow Construction 17 3.3.3 Scenario-Aware Vulnerability Reasoning 19 3.4 Model Selection 20 3.5 Business-Flow Analysis 24 3.6 Targeted Knowledge Retrieval 28 3.7 Workflow-Oriented Vulnerability Analysis 31 3.8 Corrective Analysis and Structured Memory Refinement 32 3.8.1 Corrective Analysis 32 3.8.2 Structured Memory Refinement 33 3.9 Overall Workflow 35 4 Performance Evaluation 40 4.1 Datasets 40 4.1.1 Bastet Dataset 41 4.1.2 SmartBugs Curated Dataset 41 4.1.3 DeFiHacks Dataset 42 4.1.4 Dataset Statistics 42 4.2 Baselines 43 4.2.1 LLM-Based Methods 43 4.2.2 Static Analysis Tool 44 4.3 Experimental Setup 44 4.3.1 Execution Environment 44 4.3.2 LLM Configuration and Experimental Settings 45 4.4 Experiment Results 45 4.4.1 Framework Component Effectiveness 49 4.4.2 Model Performance, Cost, and Stability Analysis 54 5 Conclusions and Future Work 60 5.1 Conclusions 60 5.2 Future Work 61 References 63

    [1] S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system.” https://bitcoin.org/bitcoin.pdf, 2008.
    [2] V. Buterin, “Ethereum: A next-generation smart contract and decentralized application platform.” https://ethereum.org/content/whitepaper/whitepaper-pdf/Ethereum_Whitepaper_-_Buterin_2014.pdf, 2014.
    [3] S. Nakamoto, “Smart contracts: Building blocks for digital markets,” 1996.
    [4] M. Alharby, A. Aldweesh, and A. van Moorsel, “Blockchain-based smart contracts: A systematic mapping study,” in 2018 International Conference on Cloud Computing, Big Data and Blockchain (ICCBB), pp. 1–6, 2018.
    [5] N. Atzei, M. Bartoletti, and T. Cimoli, “A survey of attacks on ethereum smart contracts sok,” in International Conference on Principles of Security and Trust, 2017.
    [6] J. Feist, G. Grieco, and A. Groce, “Slither: A static analysis framework for smart contracts,” in 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain, 2019.
    [7] C. Diligence, “Mythril.” https://github.com/ConsenSysDiligence/mythril, 2018.
    [8] T. Durieux, J. F. Ferreira, R. Abreu, and P. Cruz, “Empirical review of automated analysis tools on 47,587 ethereum smart contracts,” in Proceedings of the ACM/IEEE 42nd International conference on software engineering, pp. 530–541, 2020.
    [9] S. Hu, T. Huang, F. ˙Ilhan, S. F. Tekin, and L. Liu, “Large language model-powered smart contract vulnerability detection: New perspectives,” in 2023 5th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications, pp. 297–306, IEEE, 2023.
    [10] B. Boi, F. Dolz, A. S. Podda, and M. Marchesi, “Vulnhunt-gpt: A smart contract vulnerabilities detector using openai’s gpt-3 large language models,” in Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing (SAC), pp. 1519–1527, ACM, 2024.
    [11] N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learning,” Advances in Neural Information Processing Systems, vol. 36, pp. 8634–8652, 2023.
    [12] C.-K. Wu, Z. R. Tam, C.-Y. Lin, Y.-N. Chen, and H.-y. Lee, “Streambench: Towards benchmarking continuous improvement of language agents,” arXiv preprint arXiv:2406.08747, 2024.
    [13] DeFiHackLabs, “Solidity security - lesson 1: Smart contract audit methodology tips.” https://defihacklabs.substack.com/p/lesson-1-smart-contract-audit-methodology, 2023.
    [14] D. A. S. Project, “Dasp top 10.” https://dasp.co, 2018.
    [15] OpenAI, “Openai api documentation.” https://developers.openai.com/api/docs/models, 2025.
    [16] Anthropic, “Claude.” https://www.anthropic.com/claude, 2025.
    [17] Google, “Gemini.” https://deepmind.google/models/gemini/, 2025.
    [18] L.Wang, C. Ma, X. Feng, et al., “A survey on large language model based autonomous agents,” Frontiers of Computer Science, 2024.
    [19] M. Chen, J. Tworek, H. Jun, et al., “Evaluating large language models trained on code,” arXiv preprint arXiv:2107.03374, 2021.
    [20] I. David, L. Zhou, K. Qin, D. Song, L. Cavallaro, and A. Gervais, “Do you still need a manual smart contract audit?,” arXiv preprint arXiv:2306.12338, 2023.
    [21] Z. Zhang, S. Wu, X. Gao, T. Jiang, and Y. Xu, “When chatgpt meets smart contract vulnerability detection: How far are we?,” arXiv preprint arXiv:2309.05520, 2023.
    [22] Y. Sun, D. Wu, Y. Xue, H. Liu, W. Ma, L. Zhang, Y. Liu, and Y. Li, “Llm4vuln: A unified evaluation framework for decoupling and enhancing llms’ vulnerability reasoning,” 2024.
    [23] J. Ma, S. Feng, J. Zeng, J. Lu, and J. Chen, “Smart contract vulnerability detection based on prompt-guided chatgpt,” in 2024 International Conference on Networking and Network Applications (NaNA), pp. 321–326, IEEE, 2024.
    [24] J. Kevin and P. Yugopuspito, “Smartllm: Smart contract auditing using custom generative ai,” CoRR, vol. abs/2502.13167, 2025.
    [25] OneSavie Lab, “Bastet.” https://github.com/OneSavieLab/Bastet, 2025.
    [26] DefiHackLabs, “Defi hacks analysis – root cause analysis.” https://web3sec.notion.site/c582b99cd7a84be48d972ca2126a2a1f?v=4671590619bd4b2ab16a15256e4fbba1.

    QR CODE