Before a full smart contract audit begins, security teams must decide whether a project should be escalated, scoped more care- fully, or declined, yet these triage decisions are still made largely through manual inspection. Existing tools provide limited sup- port for this stage: vulnerability analyzers focus on low-level ex- ploitability, while access-control analyses enumerate privileged functions without recovering the benefit-level semantics needed to assess participation-dependent logic or concentrated administrative power. We present RiskScope, a pre-audit triage framework that identifies two classes of risk signals in smart contracts: incentive risk, when a user-facing benefit depends on non-local participation, and control risk, when privileged roles can later alter or disable that benefit. RiskScope introduces Benefit Formation Graphs (BFGs), which connect benefit surfaces, governing predicates, update paths, and privileged control surfaces into a unified structure that ex- plains how user-visible outcomes are formed and who can reshape them. A static analysis stage recovers these structures from contract source code, and an LLM-guided triage stage interprets the recov- ered evidence into structured, auditor-facing findings. We evaluate RiskScope on three public corpora totaling over 2,500 parsed con- tracts. On an incentive-heavy corpus, RiskScope achieves 92.1% recall at 79.5% precision for contract-level triage, while producing zero triage findings on a corpus of widely used library contracts. RiskScope provides compact, interpretable evidence for early audit prioritization.

@inproceedings{paperbot12417,
  title = {RiskScope: Pre-audit Triage for Incentive and Control Risks in Smart Contracts},
  author = {Yu Pan and Qi Zhang and Yuannan Yang and Dan She},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3834510}
}