一句话：提出基于LLM多智能体的污点分析系统ACTaint，用于检测Solidity智能合约访问控制漏洞。
智能合约常管理大量资产，访问控制漏洞可造成重大财务损失；现有检测方法多依赖人工规则和模式匹配的静态分析，难以理解合约业务逻辑且泛化受限。本文提出基于LLM的多智能体系统ACTaint，用于检测Solidity合约访问控制漏洞。ACTaint首先执行静态分析，引导sink智能体识别潜在sink；随后由taint智能体基于这些sink进行污点分析，判断是否存在从不可信源到sink的数据流。作者在已知CVE案例、624个真实合约和93个真实合约三类数据集上评估；在CVE案例上，召回率和F1超过AChecker与GPTLens；在624个真实合约上，相较AChecker精确率提升8.3%、F1提升9.7%。
Smart contracts have become a foundational component of blockchain systems, enabling decentralized, transparent, and autonomous execution of application logic across various domains, including decentralized finance (DeFi), gaming, and digital identity. Due to their immutable and trustless nature, smart contracts often manage and transfer substantial amounts of assets without human intervention. However, vulnerabilities in smart contracts can lead to substantial financial losses. Among these, access control vulnerabilities are particularly critical, typically originating from inadequately designed or incorrectly implemented permission mechanisms. Most existing methods for detecting access control vulnerabilities are based on static analysis, which heavily relies on manually defined rules and pattern matching. While these methods are efficient at identifying certain classes of known vulnerabilities, they are inherently limited in scope and generalization. In particular, they often fail to capture the underlying business logic of smart contracts.In this paper, we propose an LLM-based multi-agent system, named ACTaint, for detecting access control vulnerabilities in Solidity smart contracts. ACTaint first performs static analysis to guide the sink agent in identifying potential sinks. Then, based on the identified sinks, the taint agent conducts taint analysis to determine whether a data flow exists from untrusted sources to these sinks. We evaluate our approach on three datasets: known CVE cases, a set of 624 real-world smart contracts, and another set of 93 real-world smart contracts. The results demonstrate that our method outperforms existing tools in both datasets. On the first dataset, our approach outperforms state-of-the-art tools, including AChecker and GPTLens, achieving higher recall and F1-score. On the second dataset, our method surpasses the leading static analysis tool AChecker, with a 8.3% improvement in precision and an 9.7% improvement in F1-score.
DOI 原文 ·
@inproceedings{paperbot9195,
title = {ACTaint: Agent-Based Taint Analysis for Access Control Vulnerabilities in Smart Contracts},
author = {Huarui Lin and Zhipeng Gao and Jiachi Chen and Xiang Chen and Xiaohu Yang and Lingfeng Bao},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00210}
}