LogicScan: 一种基于大语言模型的智能合约业务逻辑漏洞检测框架
LogicScan: An LLM-driven Framework for Detecting Business Logic Vulnerabilities in Smart Contracts
AI总结：
LogicScan利用大语言模型和业务规范语言，通过挖掘链上协议的业务不变量，实现对智能合约业务逻辑漏洞的高效检测。
摘要：
智能合约中的业务逻辑漏洞已成为最具破坏性却最不为人知的漏洞类型之一。与传统错误如重入或算术错误不同，这些漏洞源于缺失或错误执行的业务不变量，并与协议语义紧密相关。现有的静态分析技术难以捕捉这种高级逻辑，而近期基于大语言模型的方法由于幻觉和验证能力有限，往往输出不稳定且准确性低。在本文中，我们提出LogicScan，一种用于检测智能合约业务逻辑漏洞的自动化对比审计框架。LogicScan的核心思想是，成熟且广泛部署的链上协议隐含地编码了经过测试且共识驱动的业务不变量。LogicScan系统地从大规模链上合约中挖掘这些不变量，并将其作为参考约束来审计目标合约。为此，LogicScan引入了一种业务规范语言（BSL）将多样化的实现模式规范化为结构化、可验证的逻辑表示。它进一步结合噪声感知的逻辑聚合与对比审计，以识别缺失或弱执行的不变量，同时缓解LLM引起的假阳性。我们对三个真实世界数据集进行了评估，包括DeFiHacks、Web3Bugs以及一组前200名审计的合约。结果表明，LogicScan实现了85.2%的F1分数，显著优于最先进的工具，同时在生产级合约上保持较低的假阳性率。额外实验表明，LogicScan在不同LLM上保持一致的性能，且具有成本效益，其假阳性抑制机制显著提高了鲁棒性。
英文摘要：
Business logic vulnerabilities have become one of the most damaging yet least understood classes of smart contract vulnerabilities. Unlike traditional bugs such as reentrancy or arithmetic errors, these vulnerabilities arise from missing or incorrectly enforced business invariants and are tightly coupled with protocol semantics. Existing static analysis techniques struggle to capture such high-level logic, while recent large language model based approaches often suffer from unstable outputs and low accuracy due to hallucination and limited verification. In this paper, we propose LogicScan, an automated contrastive auditing framework for detecting business logic vulnerabilities in smart contracts. The key insight behind LogicScan is that mature, widely deployed on-chain protocols implicitly encode well-tested and consensus-driven business invariants. LogicScan systematically mines these invariants from large-scale on-chain contracts and reuses them as reference constraints to audit target contracts. To achieve this, LogicScan introduces a Business Specification Language (BSL) to normalize diverse implementation patterns into structured, verifiable logic representations. It further combines noise-aware logic aggregation with contrastive auditing to identify missing or weakly enforced invariants while mitigating LLM-induced false positives. We evaluate LogicScan on three real-world datasets, including DeFiHacks, Web3Bugs, and a set of top-200 audited contracts. The results show that LogicScan achieves an F1 score of 85.2%, significantly outperforming state-of-the-art tools while maintaining a low false-positive rate on production-grade contracts. Additional experiments demonstrate that LogicScan maintains consistent performance across different LLMs and is cost-effective, and that its false-positive suppression mechanisms substantially improve robustness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
