一句话:提出多智能体框架 SecChain,用持久化 SecuritySpec 将安全义务贯穿智能合约的规划、编码、测试、审计与修复全过程。
LLM 生成的智能合约虽能通过编译,却常违反基本安全义务,而现有生成框架多把安全当作事后验证,而非贯穿生成与修复全过程的约束。本文提出 SecChain:以持久化的 SecuritySpec 工件把需求级安全义务显式化,并在规划、编码、测试、审计与修复各阶段保持其约束力。系统由五个 LLM 智能体与一个完全确定性的 Coordinator 协作,采用分阶段流程、确定性预测试验证与嵌套修复循环,另由 Auditor 基于三层安全知识库提供语义审查。在 FSM-SCG 数据集的 1000 个合约上,与 GPT-4o、GPT-5.4、Claude Sonnet 4.6 及 FSM-SCG 框架对比,SecChain 达到 89.0% 的最终编译率与 60.3% 的零风险合约比例(ZRCP),而原始 GPT-4o 仅 12.7%、FSM-SCG 为 23.3%;即使以 GPT-4o 为基座,其在主要安全指标上仍优于所测试的当前代模型。
Smart contracts generated by large language models (LLMs) can compile yet still violate basic security obligations, and existing generation frameworks largely treat security as post-hoc verification rather than as a constraint that persists throughout generation and repair. We present SecChain, a multi-agent smart-contract generation framework built around a persistent SecuritySpec artifact that makes requirement-level security obligations explicit and preserves them across planning, coding, testing, auditing, and fixing. Five LLM-powered agents collaborate with a fully deterministic Coordinator through stage-specific procedures, deterministic pre-test verification, and nested repair loops, while an Auditor provides complementary semantic review grounded in a three-layer security knowledge base. We evaluate SecChain on 1,000 contracts from the finite-state-machine-guided smart-contract generation (FSM-SCG) dataset against vanilla GPT-4o, GPT-5.4, Claude Sonnet 4.6, and the FSM-SCG framework. SecChain achieves an 89.0% final compilation rate and a Zero Risk Contract Proportion (ZRCP) of 60.3%, compared with 12.7% for vanilla GPT-4o and 23.3% for FSM-SCG. With a GPT-4o backbone, SecChain still outperforms the tested vanilla current-generation models (GPT-5.4, Claude Sonnet 4.6) on the primary security metrics.