KI findet und erklaert Schwachstellen in Smart Contracts

by Japan Advanced Institute of Science and Technology

edited by Swati Mestri, reviewed by Robert Egan

This article has been reviewed according to Science X's editorial process and policies. Editors have highlighted the following attributes while ensuring the content's credibility:

Add to Preferred Sources Credit: Morthy Jameson from Pexels Smart contracts are computer programs that run on blockchains and carry out agreements automatically, like a vending machine that releases a product once payment is made. Today they power cryptocurrency payments, online lending and exchange services, digital collectibles and more, often holding large sums of money directly.

But smart contracts have a critical weakness: Once deployed, their code cannot be changed. A single programming mistake becomes a permanent opening for attackers, and stolen funds are rarely recovered.

Automated tools exist to catch such flaws before release, but they have important limits. Many judge only whether an entire contract looks risky, leaving developers to hunt for the faulty part by hand. Most return terse warnings with no explanation of why the code is dangerous or how to fix it. And there has been no large data set labeling flaws at the level of individual functions, the building blocks developers actually write and review.

To address these problems, a research team led by professor Le-Minh Nguyen and doctoral student Ngoc-Minh Nguyen from the Japan Advanced Institute of Science and Technology (JAIST) developed a unified framework for detecting and explaining smart contract vulnerabilities.

Their study was published in ACM Transactions on Software Engineering and Methodology on Sept. 15, 2026.

The framework has three parts. First, the team built a tool that automatically inserts realistic flaws into real contracts, producing a publicly available data set of 4,208 contracts and more than 118,000 functions across eight vulnerability types.

Second, they designed a graph neural network, HCA-SGNN, that represents each contract as a network of connected code elements and analyzes each function individually while also modeling how functions interact, which is key for attacks such as reentrancy that exploit several functions at once. This allows the model to locate exactly where a vulnerability lies, rather than simply labeling the whole contract as unsafe.

Third, large language models generate structured reports describing each flaw's type, location, cause, impact and fix. These abilities were then distilled into compact models that run on ordinary hardware.

On 242 real-world contracts, HCA-SGNN outperformed existing detection methods and general-purpose language models fine-tuned for the same task. It also detected several vulnerability types absent from its training data. The compact explanation models achieved about 97%–98% of the quality of large commercial models.

The researchers see applications in prerelease security audits, developer tools and faster, lower-cost reviews for blockchain-based financial services. "For AI to be truly useful in security, people need to understand why it raises an alarm. Our system points to the exact part of a program that is dangerous and explains the risk in plain language. We believe this kind of explainable AI is key to building software that people can trust," concludes professor Nguyen.

Ngoc Minh Nguyen et al., A Unified Framework for Function-Level Vulnerability Detection and Explanation in Smart Contracts, ACM Transactions on Software Engineering and Methodology (2026). DOI: 10.1145/3840386 Key concepts AI alignment AI governance Cybersecurity frameworks Trustworthy machine learning Generative AI ethics Provided by Japan Advanced Institute of Science and Technology Who's behind this story? Swati Mestri Swati Mestri holds a bachelor's degree in Electronics Engineering and has worked as a content editor since 2019. She has experience editing research documents across technology, health care, and materials science, and has a particular interest in technology and space. Full profile →

Bachelor's in mathematical biology, Master's in creative writing. Well-traveled with unique perspectives on science and language. Full profile →