一句话：提出 TracExp，从交易轨迹自动合成智能合约攻击 PoC，结合反编译与草图合成并由 LLM 生成可验证代码。
链上攻击导致巨额损失，但复现攻击依赖人工编写 PoC，耗时且难以规模化。论文提出 TracExp，首次直接从交易轨迹自动合成 PoC：其双路反编译器将符号提升与具体运行时值融合，生成语义增强的伪代码；随后采用基于草图（sketch）的合成与精化机制，以执行上下文约束 LLM 生成并保证语义正确。在 20 个月收集的 321 个真实 DeFi 攻击上，TracExp 的生成率 94.70%、可编译率 83.80%、可验证率 57.01%，平均成本约 $0.1/例。作者还向 DeFiHackLabs 贡献 33 个此前缺失的 PoC，均被接受合并并获得 900 美元赏金，显示实际效果与影响。
Blockchain systems are increasingly targeted by on-chain attacks that exploit vulnerabilities in smart contracts, resulting in billions of dollars in losses. Understanding and reproducing these attacks is critical for defense, yet currently relies on manually crafting proofs-of-concept (PoCs), which is labor-intensive, expertise-driven, and difficult to scale. In this work, we take the first step toward automating PoC synthesis directly from transaction traces. Our key insight is that a concrete execution trace provides not only behavioral evidence for recovering exploit logic, but also runtime semantics that enable precise code synthesis and verification. We design TracExp, a trace-driven framework that combines a dual decompiler, which fuses symbolic lifting with concrete runtime values to produce semantically enriched pseudocode, and a sketch-based synthesis and refinement mechanism that grounds LLM generation in execution context and ensures semantic correctness. Evaluated on 321 real-world DeFi attacks collected over 20 months, TracExp achieves 94.70% generation, 83.80% compilable, and 57.01% verifiable rates, at an average cost of ∼$0.1 per case. Moreover, we contributed 33 previously unavailable PoCs within 2 days to DeFiHackLabs, and all were accepted and merged, earning $900 in bounties, demonstrating both the practical effectiveness and real-world impact.
@inproceedings{paperbot12268,
title = {Trace-Driven Automated PoC Synthesis for On-Chain Attacks},
author = {Xing Su and Hao Wu and Hanzhong Liang and Yunlin Jiang and Yuxi Cheng and Yating Liu and Fengyuan Xu and Sheng Zhong},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834332}
}