arXiv:2604.06975v1 [cs.CR] 8 Apr 2026
PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement Xiaoqi Li
Xin Wang∗
[email protected] Hainan University Haikou, China
[email protected] Hainan University Haikou, China
Wenkai Li
Zongwei Li
[email protected] Hainan University Haikou, China
[email protected] Hainan University Haikou, China
Abstract With the rapid advancement of decentralized applications, smart contract security faces severe challenges, particularly regarding atomicity violations in complex logic such as Oracle and NFT contracts. Rigid rule sets often limit traditional static analyzers and lack deep contextual awareness, leading to high false-positive and false-negative rates when identifying vulnerabilities that depend on intermediate state inconsistencies. To address these limitations, this paper proposes PSR2 , a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning. PSR2 utilizes a Graph Structure Analysis Module (GSAM) to identify suspicious execution sequences in control flow graphs and a Semantic Context Analysis Module (SCAM) to extract data dependencies and state facts from abstract syntax trees. A Fusion Decision Module (FDM) then performs formal cross validation to confirm vulnerabilities based on a unified atomicity inconsistency model. Experimental results on 1,600 contract samples demonstrate that PSR2 significantly outperforms patternmatching baselines, achieving an F1-score of 94.69% in complex ERC-721 scenarios compared to 51.86% for existing tools. Ablation studies further confirm that our fusion logic effectively reduces the false-positive rate by nearly half compared to single module analysis.
CCS Concepts • Security and privacy → Software and application security.
Keywords Smart Contract, Atomicity Violation, Static Analysis, Information Fusion ACM Reference Format: Xiaoqi Li, Xin Wang, Wenkai Li, and Zongwei Li. 2026. PSR2 : A Phasebased Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement. In 34th ACM Joint European Software Engineering ∗ Corresponding author.
This work is licensed under a Creative Commons Attribution 4.0 International License. FSE Companion ’26, Montreal, QC, Canada © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2636-1/2026/07 https://doi.org/10.1145/3803437.3805575
Conference and Symposium on the Foundations of Software Engineering (FSE Companion ’26), July 05–09, 2026, Montreal, QC, Canada. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3803437.3805575
1
Introduction
Oracles [2, 7] serve as critical bridges for external data integration within decentralized finance [39]. However, the complexity of crossdomain interactions makes them highly susceptible to atomicity violations [1, 30]. Traditional security analysis relies heavily on static analysis tools like Slither [8] and pattern matching engines like Semgrep [5]. While these approaches can identify surfacelevel vulnerabilities, they struggle with the deep state consistency and operation sequencing required in complex Oracle and NFT contracts [34]. This inadequacy fundamentally stems from two limitations: Challenge 1 (C1): Contextual Blindness. Tools based on rigid rule sets often lack deep semantic awareness of variable dependencies, leading to high false positive rates by failing to distinguish benign updates [14] from malicious exploitations [29]. Challenge 2 (C2): Topological Insensitivity. Pattern matching approaches focus on local code syntax but often fail to verify if a hazardous pattern is reachable via a valid control flow path. This limitation challenges the ability to detect implicit vulnerabilities (e.g., in ERC-721 callbacks) where the risk is embedded in the global execution topology rather than local syntax [6], resulting in false negatives. To address these challenges, we propose PSR2 , a collaborative static analysis framework. PSR2 integrates structural path searching with deterministic semantic reasoning [12]. By fusing graph-based evidence with semantic facts, our framework effectively eliminates structural ambiguities, ultimately enhancing both the precision and recall of vulnerability detection. Solution to C1: PSR2 employs a Semantic Context Analysis Module (SCAM) to parse the smart contract into an Abstract Syntax Tree (AST) [31]. SCSA extracts deterministic semantic facts, such as data dependency sets and function roles, providing a rigorous logical foundation to filter out contextually invalid risks. Solution to C2: PSR2 framework utilizes a Graph Structure Analysis Module (GSAM) to construct a simplified Control Flow Graph (CFG) and identify reachable hazardous paths (e.g., Read-Call-Write sequences) [27]. A Fusion Decision Module (FDM) then cross validates these paths against semantic facts to resolve topological
FSE Companion ’26, July 05–09, 2026, Montreal, QC, Canada
ambiguity. This prunes structurally valid but semantically infeasible paths. The main contributions of this paper are as follows: • We propose PSR2 , a novel framework that harmonizes pathsensitive graph analysis with context-aware semantic extraction. It effectively resolves the trade-off between false positives and false negatives inherent in traditional tools. • We define a Unified Atomicity Inconsistency Model that abstracts diverse vulnerabilities into a consistent logic primitive. Extensive experiments on 1,600 samples demonstrate that PSR2 outperforms traditional static analysis tools, achieving a 94.69% F1-score in complex ERC-721 scenarios [4]. • We design a Fusion Decision Module (FDM) that aligns structural paths with semantic data flows for accurate and interpretable vulnerability detection.
2
Xiaoqi Li, Xin Wang, Wenkai Li, and Zongwei Li
G = (𝑁 ′, 𝐸 ′ ) using a labeling function 𝛼 : 𝑁 → 𝑇 [3, 35]. This function maps nodes to critical atomicity related operations, filtering out irrelevant logic: 𝑠 ∈ V, SLOAD(𝑠), SSTORE(𝑠), 𝑇 = CALL(𝑡), CHECK, OTHER 𝑡 ∈ AddressType The simplified graph nodes are defined as 𝑁 ′ = {𝛼 (𝑛) | 𝑛 ∈ 𝑁 }, preserving the original control flow edges 𝐸 ′ . Atomicity Pattern Verification: GSAM identifies "Dependent State Paths" that contain both read and write operations on a critical variable 𝑠. For any such path 𝑃 = ⟨𝑛 1, . . . , 𝑛𝑘 ⟩, the module evaluates the atomicity safety predicate 𝜙 atomic (𝑃, 𝑠). A violation is flagged if an external call interrupts the read write sequence [38, 42]: 𝜙 atomic (𝑃, 𝑠) ⇐⇒ ∃𝑖, 𝑚, 𝑗 ∈ [1, 𝑘] :
∧ (𝛼 (𝑛𝑖 ) = SLOAD(𝑠)) ∧ (𝛼 (𝑛𝑚 ) = CALL(𝑡))
Method
∧ (𝛼 (𝑛 𝑗 ) = SSTORE(𝑠))
As shown in Fig. 1, 𝑃𝑆𝑅 2 involves three stages: (1) Semantic Context Analysis Module (SCAM): Parses source code 𝐶 into semantic facts. (2) Graph Structure Analysis Module (GSAM): Searches the Control Flow Graph (CFG) for hazardous paths (e.g., “SLOAD→CALL→ SSTORE”). (3) Fusion Decision Module (FDM): Cross-validates GSAM and SCAM findings to filter false positives and confirm atomicity violations [15, 25].
2.1
SCAM
This stage establishes the logical ground truth by parsing the contract 𝐶 into a deterministic semantic repository F , eliminating probabilistic guessing: F = (F, V, E) Function and State Profiling (F, V): SCAM first maps the contract’s static topology. For every function 𝑓 and state variable 𝑣, it derives formal descriptors to categorize logical roles and access patterns: 𝐷 𝑓 = (id, name, role) 𝐷 𝑣 = (id, name, type, {(𝑓 , 𝐴(𝑣, 𝑓 ))}) Here, role is assigned by matching signatures against a keyword set Σ = {price, update, . . . }, and 𝐴(𝑣, 𝑓 ) ∈ {read, write, RW} is determined via AST traversal. The resulting set V = {𝐷 𝑣 } serves as the baseline for global dependency tracking. Interaction Dependency Extraction (E): To capture atomicity risks, SCAM analyzes every external call site 𝑒, generating a critical fact tuple 𝑇𝑒 : 𝑇𝑒 = (loc, type, tgt, D) Where loc denotes code coordinates, and tgt classifies the target source (e.g., fixed address vs. user input). Crucially, SCAM performs data flow analysis to construct the dependency set D ⊆ V [9, 36], which identifies specifically which state variables dictate the call’s parameters or execution conditions.
2.2
GSAM
The GSAM transforms the contract’s CFG into a formal model to verify path reachability and operation sequencing. It outputs a set of suspicious paths Psuspicious satisfying risk patterns, providing structural evidence for the FDM. Graph Construction and Abstraction: Instead of analyzing raw basic blocks, GSAM projects the contract into a simplified graph
(𝑖 < 𝑚 < 𝑗)
The final output is a repository of structurally risky paths, defined as: Ograph = {(R, 𝑃, 𝑠, Seq) | 𝑃 ∈ Pcandidate ∧ 𝜙 atomic (𝑃, 𝑠)} where Seq denotes the evidence node sequence.
2.3
FDM
Operating as the logical gatekeeper, the FDM synthesizes structural alerts 𝐼𝐺 from GSAM and semantic facts 𝐼𝑆 from SCAM. Contextual Analysis: For each suspicious path report 𝑅 𝑗 ∈ 𝐼𝐺 involving state variable 𝑠, the FDM constructs a semantic context annotation 𝐶 𝑗,𝑠 = (tgt, dep, interm) by querying 𝐼𝑆 : • tgt: The call target type retrieved from facts 𝑇𝑒 . • dep: Boolean flag, true iff 𝑠 ∈ 𝑇𝑒 .D (verifying data dependency). • interm: Boolean flag, true iff the call occurs strictly between SLOAD(𝑠) and SSTORE(𝑠) (verifying intermediate state inconsistency). Fused Decision Logic: The module executes a deterministic decision function F to assign risk levels. A vulnerability is confirmed only when structural reachability is cross-validated by semantic dependencies: F (𝑃 𝑗 , 𝑠), 𝐶 𝑗,𝑠
(High, 𝐷 𝑗,𝑠 ) = (Medium, 𝐷 𝑗,𝑠 ) (Low, ∅)
if dep ∧ interm ∧ tgt ≠ fixed if dep ∧ interm ∧ tgt = fixed otherwise
If the risk is High or Medium, a structured evidence report 𝐷 𝑗,𝑠 is synthesized, encapsulating the verification chain {Verdict, 𝑃 𝑗 , 𝑠,𝑇𝑒 , 𝐶 𝑗,𝑠 }. Final Output: The system yields a comprehensive security report Ofusion , representing the union of all validated atomicity violations: Ø Ofusion = F (𝑃 𝑗 , 𝑠), 𝐶 𝑗,𝑠
3
Experiment
𝑗,𝑠
Experimental Setup & Baselines. We evaluate PSR2 on a comprehensive dataset of 1,600 samples across three benchmarks: SmartbugsReentrancy, ERC-721 Reentrancy (featuring complex implicit callbacks), and Smartbugs-Unchecked External Call.
PSR2 : A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement FSE Companion ’26, July 05–09, 2026, Montreal, QC, Canada
Figure 1: Architecture of the PSR2 framework. It integrates parallel analysis from GSAM and SCAM modules, followed by a collaborative fusion decision for final vulnerability assessment. We compare PSR2 against two state-of-the-art industry tools: Slither (static analysis) and Semgrep (pattern matching). Our evaluation addresses three key questions: RQ1: How does PSR2 compare to baselines in detection accuracy? RQ2: What is the specific contribution of each module to the synergy? RQ3: How generalizable is the unified model across diverse risks? Table 1: Performance Comparison across Multiple Datasets Dataset
Tool Precision (%) Recall (%) F1-score (%) Slither 12.50 2.94 4.76 Reentrancy Semgrep 71.32 95.10 81.51 PSR2 78.13 98.04 87.72 Slither 16.31 21.45 23.68 ERC-721 Reent. Semgrep 59.90 45.73 51.86 PSR2 94.94 89.91 94.69 Slither 74.12 71.93 73.54 Unchecked Semgrep 55.00 9.65 16.42 PSR2 84.35 98.04 91.95
3.1
Performance Analysis (RQ1)
As shown in Table 1, PSR2 consistently achieves the highest F1scores across all datasets, demonstrating significant advantages in both Precision and Recall. Handling Complex Callbacks (ERC-721): PSR2 achieves a dominant F1-score of 94.69%, far surpassing Semgrep (51.86%) and Slither (23.68%). Slither suffers from "Contextual Blindness" (C1), failing to trace control flows when external calls trigger implicit callbacks (e.g., onERC721Received) [41]. Conversely, Semgrep is limited by topological insensitivity, merely matching local syntax without verifying strict reachability. PSR2 overcomes these limitations by effectively fusing topological searching (GSAM) with semantic verification (SCAM). Generalizability: On the Unchecked dataset, PSR2 maintains a high recall of 98.04%, whereas Semgrep drops drastically to 9.65%. This sharp decline reveals the fragility of pattern based detection relying on rigid rules [13]. Driven by a unified "Atomic Inconsistency" model rather than fixed signatures, PSR2 demonstrates superior
FSE Companion ’26, July 05–09, 2026, Montreal, QC, Canada
Xiaoqi Li, Xin Wang, Wenkai Li, and Zongwei Li
robustness across diverse and non-standard implementation styles. Answer to RQ1: PSR2 significantly outperforms existing baselines. By effectively coupling structural path searching with deep semantic reasoning, it eliminates the context blindness and pattern rigidity inherent in traditional static analyzers, ensuring high accuracy and generalizability.
3.2
Answer to RQ3: PSR2 achieves high generalizability by abstracting diverse bugs into a unified triplet (𝑃 𝑗 ,𝑇𝑒 , 𝐷𝑠 ). Through semantic reasoning, the FDM consistently detects "Atomicity Violations", effectively transcending traditional rule-based limitations.
Ablation Study (RQ2)
To evaluate the synergy of multi-module fusion, we compare the 2 full framework against two decoupled variants: 𝑃𝑆𝑅𝐺𝑆𝐴𝑀 (Graphonly, strictly structural analysis without semantic confirmation) 2 and 𝑃𝑆𝑅𝑆𝐶𝐴𝑀 (Semantic-only, pattern matching without path verification). To mitigate class imbalance bias, we evaluated on a strictly balanced dataset comprising 719 vulnerable (𝐷 𝑣𝑢𝑙𝑛 ) and 719 safe (𝐷𝑠𝑎𝑓 𝑒 ) contracts. Table 2: Ablation Metrics on Decoupled Datasets Configuration 2 𝑃𝑆𝑅𝐺𝑆𝐴𝑀 2 𝑃𝑆𝑅𝑆𝐶𝐴𝑀 2 𝑃𝑆𝑅𝐹𝑢𝑙𝑙
𝐷 𝑣𝑢𝑙𝑛 (Rec.) Count % 639 88.87% 602 83.77% 664 92.35%
𝐷𝑠𝑎𝑓 𝑒 (FPR) Count % 81 11.27% 639 88.81% 46 6.40%
Over. 𝐹 1 88.81% 64.90% 92.93%
As shown in Table 2, decoupled modules suffer from logical 2 blindness. 𝑃𝑆𝑅𝑆𝐶𝐴𝑀 exhibits extreme over reporting (𝐹 𝑃𝑅 = 88.81%) as it flags patterns regardless of execution feasibility. Similarly, 2 𝑃𝑆𝑅𝐺𝑆𝐴𝑀 generates structural noise (𝐹 𝑃𝑅 = 11.27%) on benign paths. The FDM effectively prunes noise by requiring semantic "Facts" (e.g., state inconsistency) to cross-validate structural paths, reducing the FPR to 6.40%. Furthermore, the fusion logic resolves the "implicit callback" blindness, elevating the recall to 92.35% by identifying complex ERC-721 vulnerabilities that rely on both structural reachability and semantic triggers. Answer to RQ2: Ablation confirms the necessity of fusing path sensitivity (GSAM) with semantic context (SCAM). FDM filters structural noise and captures implicit vulnerabilities that decoupled modules miss.
3.3
by semantic dependencies (𝐸𝑆 .dep).This logical consistency facilitates the high performance observed in Table 1. This generality is most evident in ERC-721 scenarios, where PSR2 uses semantic reasoning to complete broken control flows (implicit paths), identifying violations that are structurally hidden to traditional tools but semantically certain.
Generality of the Unified Model (RQ3)
CrossCategory Primitive Extraction: The core innovation is refining raw code into a unified "Atomic Inconsistency" primitive. Our evaluation reveals that diverse vulnerabilities share the same root logic: Reentrancy (explicit and implicit) is refined as a structural violation sequence ⟨SLOAD(𝑠), CALL(𝑡), SSTORE(𝑠)⟩, confirming the breach of the "Check-Effects-Interactions" pattern. Unchecked External Calls are treated as logic-state inconsistencies where execution proceeds to SSTORE without validation from the call’s return value (𝑇𝑒 ). Crucially, both categories share the same pathological root: a critical variable resides in an "Intermediate State" (loaded but not yet committed) during a side-effect-heavy interaction [16]. Unified Decision Logic. The FDM applies a standardized decision function F regardless of the specific vulnerability signature. It confirms risks only when structural reachability is cross-validated
4
DISCUSSION
PSR2 achieves high precision by utilizing the FDA as a logical gatekeeper [37] to filter structural noise through the cross-validation of GSAA’s paths and SCSA’s semantic facts. This synergy allows the detection of “structurally hidden” reentrancy in ERC-721 callbacks via interaction dependency extraction, addressing the limitations of pattern matching [28]. However, mapping complete dependency sets D remains challenging for cross-contract calls without source code [26], a domain where semantic lifting at the bytecode level becomes essential [11, 19]. By refining diverse risks into structured primitives (𝑃 𝑗 ,𝑇𝑒 , 𝐷𝑠 ), the unified model transcends manual rulewriting and establishes a scalable foundation for securing evolving DeFi protocols against sophisticated cross-contract exploits [22].
5
Related Work
Static analysis utilizes intermediate representations to verify program safety [20, 33], but faces path explosion and high false-positive rates due to limited semantic context. Conversely, pattern matching provides computational efficiency [43] but lacks topological sensitivity for implicit control flows like cross-function callbacks [23]. Despite recent graph-based advances in transaction network monitoring [21], existing frameworks still struggle to unify structural reachability with semantic dependency [24] often missing atomicity violations that require simultaneous path and state verification [32].
6
CONCLUSION
We propose PSR2 , a framework integrating path-sensitive graph analysis with context-aware semantic extraction. Its multi-module architecture (SCAM, GSAM, and FDM) effectively resolves the precision-recall tradeoff. Experiments show a 94.69% F1-score in complex ERC-721 scenarios, significantly outperforming state-ofthe-art tools [40]. This work establishes a unified approach to securing decentralized systems against atomicity violations [10], ensuring deep state consistency [18] and supporting broader blockchain applications, such as IoT data sharing [17].
7
ACKNOWLEDGMENTS
This work is sponsored by the National Natural Science Foundation of China (No.62362021, No.62402146). We also acknowledge the use of AI translation software for grammar improvement and text polishing.
PSR2 : A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement FSE Companion ’26, July 05–09, 2026, Montreal, QC, Canada
References [1] Syed Badruddoja, Ram Dantu, Yanyan He, Kritagya Upadhayay, and Mark Thompson. 2021. Making smart contracts smarter. In 2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC). IEEE, 1–3. [2] Giulio Caldarelli. 2025. Can artificial intelligence solve the blockchain oracle problem? unpacking the challenges and possibilities. Frontiers in Blockchain 8 (2025), 1682623. [3] Yuanlong Cao, Fan Jiang, Jianmao Xiao, Shaolong Chen, Wei Yang, and Yugen Yi. 2023. Data flow-driven and attention mechanism-enabled smart contract vulnerability detection for secure and green blockchain-based service networks. In ICC 2023-IEEE International Conference on Communications. IEEE, 5135–5140. [4] Dipanjan Das, Priyanka Bose, Nicola Ruaro, Christopher Kruegel, and Giovanni Vigna. 2022. Understanding security issues in the NFT ecosystem. In Proceedings of the 2022 ACM SIGSAC conference on computer and communications security. 667–681. [5] Thomas Durieux, João F Ferreira, Rui Abreu, and Pedro Cruz. 2020. Empirical review of automated analysis tools on 47,587 ethereum smart contracts. In Proceedings of the ACM/IEEE 42nd International conference on software engineering. 530–541. [6] Phan The Duy, Nghi Hoang Khoa, Nguyen Huu Quyen, Le Cong Trinh, Vu Trung Kien, Trinh Minh Hoang, and Van-Hau Pham. 2025. Vulnsense: Efficient vulnerability detection in ethereum smart contracts by multimodal learning with graph neural network and language model. International Journal of Information Security 24, 1 (2025), 48. [7] Shayan Eskandari, Mehdi Salehi, Wanyun Catherine Gu, and Jeremy Clark. 2021. Sok: Oracles from the ground truth to market manipulation. In Proceedings of the 3rd ACM Conference on Advances in Financial Technologies. 127–141. [8] Josselin Feist, Gustavo Grieco, and Alex Groce. 2019. Slither: a static analysis framework for smart contracts. In 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB). IEEE, 8–15. [9] Asem Ghaleb. 2022. Towards effective static analysis approaches for security vulnerabilities in smart contracts. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering. 1–5. [10] Krzysztof Gogol, Christian Killer, Malte Schlosser, Thomas Bocek, Burkhard Stiller, and Claudio Tessone. 2024. SoK: Decentralized Finance (DeFi)– Fundamentals, Taxonomy and Risks. arXiv preprint arXiv:2404.11281 (2024). [11] Neville Grech, Sifis Lagouvardos, Ilias Tsatiris, and Yannis Smaragdakis. 2022. Elipmoc: Advanced decompilation of ethereum smart contracts. Proceedings of the ACM on Programming Languages 6, OOPSLA1 (2022), 1–27. [12] Jiaxing Guo, Dongliang Zhao, Chunxiang Gu, Xi Chen, Xieli Zhang, and Mengcheng Ju. 2024. An enhanced state-aware model learning approach for security analysis in lightweight protocol implementations. Journal of Cloud Computing 13, 1 (2024), 28. [13] Sowon Jeon, Gilhee Lee, Hyoungshick Kim, and Simon S Woo. 2024. Design and evaluation of highly accurate smart contract code vulnerability detection framework. Data Mining and Knowledge Discovery 38, 3 (2024), 888–912. [14] Kashif Mehboob Khan and Ansha Zahid. 2022. Empirical analysis of vulnerabilities in blockchain-based smart contracts. Sir Syed University Research Journal of Engineering & Technology 12, 1 (2022), 78–85. [15] Kaixuan Li, Yue Xue, Sen Chen, Han Liu, Kairan Sun, Ming Hu, Haijun Wang, Yang Liu, and Yixiang Chen. 2024. Static application security testing (sast) tools for smart contracts: How far are we? Proceedings of the ACM on Software Engineering 1, FSE (2024), 1447–1470. [16] Lantian Li, Yuyu Chen, Jingwen Wu, Yue Pan, and Zhongxing Yu. 2025. Understanding inconsistent state update vulnerabilities in smart contracts. ACM Transactions on Software Engineering and Methodology (2025). [17] Xiaoqi Li, Ting Chen, Xiapu Luo, and Chenxu Wang. 2021. Clue: towards discovering locked cryptocurrencies in ethereum. In Proceedings of the 36th Annual ACM Symposium on Applied Computing. 1584–1587. [18] Xiaoqi Li, Ting Chen, Xiapu Luo, and Jiangshan Yu. 2020. Characterizing erasable accounts in ethereum. In International Conference on Information Security. Springer, 352–371. [19] Xiaoqi Li, Ting Chen, Xiapu Luo, Tao Zhang, Le Yu, and Zhou Xu. 2020. Stan: Towards describing bytecodes of smart contract. In 2020 IEEE 20th International Conference on Software Quality, Reliability and Security (QRS). IEEE, 273–284. [20] Xiaoqi Li, Peng Jiang, Ting Chen, Xiapu Luo, and Qiaoyan Wen. 2020. A survey on the security of blockchain systems. Future generation computer systems 107 (2020), 841–853. [21] Xiaoqi Li, Wenkai Li, Zhijie Liu, Meikang Qiu, Zhiquan Liu, Sen Nie, Zongwei Li, Shi Wu, and Yuqing Zhang. 2025. ScamSweeper: Detecting Illegal Accounts in Web3 Scams via Transactions Analysis. IEEE Transactions on Information Forensics and Security 21 (2025), 91–104. [22] Xiaoqi Li, Wenkai Li, Zhiquan Liu, Yuqing Zhang, and Yingjie Mao. 2025. Penetrating the hostile: detecting DeFi protocol exploits through cross-contract analysis. IEEE Transactions on Information Forensics and Security 20 (2025), 11759–11774.
[23] Xiaoqi Li, Zongwei Li, Wenkai Li, Yuqing Zhang, and Xin Wang. 2025. No More Hidden Pitfalls? Exposing Smart Contract Bad Practices with LLM-Powered Hybrid Analysis. ACM Transactions on Software Engineering and Methodology (2025). [24] Yinxi Liu, Wei Meng, and Yinqian Zhang. 2025. Detecting smart contract stateinconsistency bugs via flow divergence and multiplex symbolic execution. Proceedings of the ACM on Software Engineering 2, FSE (2025), 22–43. [25] Zhenkun Luo, Shuhong Chen, Guojun Wang, and Hanjun Li. 2023. Two-Stage Smart Contract Vulnerability Detection Combining Semantic Features and Graph Features. In 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 257–264. [26] Deepa Mishra and Shraddha Phansalkar. 2025. Blockchain Security in Focus: A Comprehensive Investigation into Threats, Smart Contract Security, Cross-Chain Bridges, Vulnerabilities Detection Tools & Techniques. IEEE Access (2025). [27] Peng Qian, Zhenguang Liu, Qinming He, Roger Zimmermann, and Xun Wang. 2020. Towards automated reentrancy detection for smart contracts based on sequential models. IEEE access 8 (2020), 19685–19695. [28] Qiyang Song, Heqing Huang, Xiaoqi Jia, Yuanbo Xie, and Jiahao Cao. 2025. Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection. In NDSS. [29] Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Haijun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. 2024. Gptscan: Detecting logic vulnerabilities in smart contracts by combining gpt with program analysis. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering. 1–13. [30] Yuechen Tao, Bo Li, and Baochun Li. 2023. On atomicity and confidentiality across blockchains under failures. IEEE Transactions on Knowledge and Data Engineering 36, 2 (2023), 766–780. [31] Sergei Tikhomirov, Ekaterina Voskresenskaya, Ivan Ivanitskiy, Ramil Takhaviev, Evgeny Marchenko, and Yaroslav Alexandrov. 2018. Smartcheck: Static analysis of ethereum smart contracts. In Proceedings of the 1st international workshop on emerging trends in software engineering for blockchain. 9–16. [32] Arianna Trozze, Bennett Kleinberg, and Toby Davies. 2024. Detecting DeFi securities violations from token smart contract code. Financial Innovation 10, 1 (2024), 1–35. [33] Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Buenzli, and Martin Vechev. 2018. Securify: Practical security analysis of smart contracts. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security. 67–82. [34] Shrey Varma, Sachin Prajapati, YashKumar Gupta, Kaushik Tondon, Shraddha Sharma, Manali Parate, and Manasi Churi. 2025. NFT Marketplaces: A Comprehensive Analysis of Trading, Security, and Metadata Challenges. International Journal on Advanced Electrical and Computer Engineering 14, 1 (2025), 55–68. [35] Bin Wang, Shan Li, Xiaohan Yuan, Xueshuo Xie, Junyong Wang, Tao Li, and Wei Wang. 2025. ContractScanner: Detecting and Localizing Vulnerabilities of Smart Contracts via Graph-Based Semantic Modeling of Source Code. IEEE Transactions on Network Science and Engineering (2025). [36] Long Wang, Zhihua Chen, Hua Pang, and Xiaoguang Li. 2024. Smart Contract Vulnerability Detection via Feature Fusion of Local Data Flow and Global Features. In 2024 IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA). IEEE, 2268–2271. [37] Zhiyuan Wei, Jing Sun, Yuqiang Sun, Ye Liu, Daoyuan Wu, Zijian Zhang, Xianhao Zhang, Meng Li, Yang Liu, Chunmiao Li, et al. 2025. Advanced smart contract vulnerability detection via llm-powered multi-agent systems. IEEE Transactions on Software Engineering (2025). [38] Yin Wu, Xiaofei Xie, Chenyang Peng, Dijun Liu, Hao Wu, Ming Fan, Ting Liu, and Haijun Wang. 2024. Advscanner: Generating adversarial smart contracts to exploit reentrancy vulnerabilities using llm and static analysis. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering. 1019–1031. [39] Rui Xi, Zehua Wang, and Karthik Pattabiraman. 2024. POMABuster: Detecting Price Oracle Manipulation Attacks in Decentralized Finance. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 3923–3942. [40] Chang Xu, Huaiyu Xu, Liehuang Zhu, Xiaodong Shen, and Kashif Sharif. 2025. Enhanced Smart Contract Vulnerability Detection via Graph Neural Networks: Achieving High Accuracy and Efficiency. IEEE Transactions on Software Engineering (2025). [41] Yinxing Xue, Mingliang Ma, Yun Lin, Yulei Sui, Jiaming Ye, and Tianyong Peng. 2020. Cross-contract static analysis for detecting practical reentrancy vulnerabilities in smart contracts. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering. 1029–1040. [42] Zhuo Zhang, Brian Zhang, Wen Xu, and Zhiqiang Lin. 2023. Demystifying exploitable bugs in smart contracts. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 615–627. [43] Zibin Zheng, Jianzhong Su, Jiachi Chen, David Lo, Zhijie Zhong, and Mingxi Ye. 2024. Dappscan: building large-scale datasets for smart contract weaknesses in dapp projects. IEEE Transactions on Software Engineering 50, 6 (2024), 1360–1373.