一句话：用 LLM 生成并执行 PoC，自动确认智能合约审计报告中的漏洞可利用性。
静态分析是审计智能合约漏洞的常用手段，但其输出通常是形式各异的告警而非可复现、可执行的 PoC，导致人工验证成本高且流程零散。本文提出 SmartPoC，将审计报告转化为可执行 PoC 并自动验证可利用性。方法上，SmartPoC 先从报告抽取以关键函数为中心的函数级切片以降低噪声，再用 LLM 在“生成–修复–执行”循环中合成 PoC，结合确定性的执行前清理与反馈驱动的执行后调试提升可执行性，并以差分验证作为 oracle 确认漏洞可利用。在 SmartBugs-Vul 和 FORGE-Vul 上，确认精确率分别达 98.32% 与 98.65%，召回率为 84.17% 与 85.28%；在 Etherscan 已验证源码语料中，从 545 条审计发现中确认 64 个 bug，平均成本 0.03 美元。
Smart contracts are commonly audited through static analysis to explore vulnerabilities. However, static approaches typically produce heterogeneous findings rather than reproducible, executable proof-of-concept (PoC) test cases, leading to costly and ad hoc manual validation. Large language models (LLMs) offer a promising way to translate audit reports into PoC test cases, but face three major challenges: noisy inputs, lack of execution grounding, and missing runtime oracles. We present SmartPoC, an end-to-end approach for validating reported vulnerabilities in audit reports by generating and executing PoC test cases with automated exploitability verification. SmartPoC first extracts a focused function-level slice from each report to reduce noise, centering on the key functions referenced in a finding and augmenting them with execution-relevant neighbors. To improve executability, we wrap LLM-based PoC synthesis in a generate–repair–execute loop, combining deterministic pre-execution sanitization with feedback-driven post-execution debugging. We further use differential verification as an oracle to confirm the exploitability of generated test cases. On the SmartBugs-Vul and FORGE-Vul benchmarks, SmartPoC achieves confirmation precision of 98.32% and 98.65%, with recall of 84.17% and 85.28%, respectively. On a recent Etherscan verified-source corpus, SmartPoC confirms 64 bugs from 545 audit findings at an average cost of $0.03.
@inproceedings{paperbot12497,
title = {SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and Execution},
author = {Longfei Chen and Ruibin Yan and Taiyu Wong and Yiyang Chen and Jialai Wang and Chao Zhang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834380}
}