paperbot · PL 论文追踪

全部论文 待读 收藏

SecChain: Operationalizing Security Guidelines for Multi-agent Smart Contract Generation

SecChain:将安全准则可操作化用于多智能体智能合约生成
ASE Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering2026引用 0 inbox
Dianxiang Sun, Liming Nie, Yang Liu
crossref: 2026-10-09

AI 速览

一句话:提出多智能体框架 SecChain,用持久化 SecuritySpec 将安全义务贯穿智能合约的规划、编码、测试、审计与修复全过程。

LLM 生成的智能合约虽能通过编译,却常违反基本安全义务,而现有生成框架多把安全当作事后验证,而非贯穿生成与修复全过程的约束。本文提出 SecChain:以持久化的 SecuritySpec 工件把需求级安全义务显式化,并在规划、编码、测试、审计与修复各阶段保持其约束力。系统由五个 LLM 智能体与一个完全确定性的 Coordinator 协作,采用分阶段流程、确定性预测试验证与嵌套修复循环,另由 Auditor 基于三层安全知识库提供语义审查。在 FSM-SCG 数据集的 1000 个合约上,与 GPT-4o、GPT-5.4、Claude Sonnet 4.6 及 FSM-SCG 框架对比,SecChain 达到 89.0% 的最终编译率与 60.3% 的零风险合约比例(ZRCP),而原始 GPT-4o 仅 12.7%、FSM-SCG 为 23.3%;即使以 GPT-4o 为基座,其在主要安全指标上仍优于所测试的当前代模型。

问题
LLM 生成的智能合约可通过编译但仍违反基本安全义务,且现有生成框架多将安全视为事后验证,未将其作为贯穿生成与修复过程的持续约束。
方法
构建以持久化 SecuritySpec 工件为核心的多智能体框架,五个 LLM 智能体与确定性 Coordinator 按阶段流程协作,配合确定性预测试验证、嵌套修复循环以及基于三层安全知识库的 Auditor 语义审查。
评估
在 FSM-SCG 数据集的 1000 个合约上与原始 GPT-4o、GPT-5.4、Claude Sonnet 4.6 和 FSM-SCG 框架对比,报告最终编译率与零风险合约比例(ZRCP)等安全指标。
原文摘要(Abstract)

Smart contracts generated by large language models (LLMs) can compile yet still violate basic security obligations, and existing generation frameworks largely treat security as post-hoc verification rather than as a constraint that persists throughout generation and repair. We present SecChain, a multi-agent smart-contract generation framework built around a persistent SecuritySpec artifact that makes requirement-level security obligations explicit and preserves them across planning, coding, testing, auditing, and fixing. Five LLM-powered agents collaborate with a fully deterministic Coordinator through stage-specific procedures, deterministic pre-test verification, and nested repair loops, while an Auditor provides complementary semantic review grounded in a three-layer security knowledge base. We evaluate SecChain on 1,000 contracts from the finite-state-machine-guided smart-contract generation (FSM-SCG) dataset against vanilla GPT-4o, GPT-5.4, Claude Sonnet 4.6, and the FSM-SCG framework. SecChain achieves an 89.0% final compilation rate and a Zero Risk Contract Proportion (ZRCP) of 60.3%, compared with 12.7% for vanilla GPT-4o and 23.3% for FSM-SCG. With a GPT-4o backbone, SecChain still outperforms the tested vanilla current-generation models (GPT-5.4, Claude Sonnet 4.6) on the primary security metrics.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@inproceedings{paperbot12482,
  title = {SecChain: Operationalizing Security Guidelines for Multi-agent Smart Contract Generation},
  author = {Dianxiang Sun and Liming Nie and Yang Liu},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3837480}
}