---
source: arxiv
url: http://arxiv.org/abs/2604.13611v2
published_at: '2026-04-15T08:24:24'
authors:
- Jingwen Zhang
- Yuhong Nan
- Kaiwen Ning
- Mingxi Ye
- Wei Li
- Yuming Xiao
- Yuming Feng
- Weizhe Zhang
- Zibin Zheng
topics:
- smart-contract-security
- vulnerability-validation
- exploit-generation
- llm-for-code
- blockchain-analysis
relevance_score: 0.72
run_id: materialize-outputs
language_code: en
---

# V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution

## Summary
V2E validates reported smart contract vulnerabilities by generating exploit PoCs, executing them, and checking whether they both trigger the bug and produce attacker profit. The paper targets a common failure mode in smart contract scanners: many reports match a vulnerable pattern but are not exploitable in practice.

## Problem
- Existing smart contract detection tools often report many false positives because they flag vulnerable code patterns without proving the code can be triggered in a real execution context.
- A triggerable bug may still be irrelevant if it does not cause financial loss or attacker profit, which matters because smart contract attacks are usually profit-driven.
- Manual validation of tool outputs is costly for auditors and developers, especially for state-dependent logic bugs such as reentrancy, transaction ordering, and randomness misuse.

## Approach
- V2E takes a vulnerability report, contract source, and function under test, then uses fine-grained static analysis to find likely exploit entry functions through state read/write dependency and access-control analysis.
- It gives the LLM a narrow prompt with the constructor, vulnerability path, and vulnerability features, then asks it to generate a targeted Foundry-based PoC instead of generating an exploit from the full contract without guidance.
- V2E executes each PoC in a customized EVM to check **triggerability** and **profitability**. A vulnerability counts as valid only if the PoC both triggers the vulnerable behavior and increases attacker profit or causes financial damage.
- If execution fails, V2E uses execution bytecode plus source mapping to locate the failure point and asks the LLM to revise the PoC. If execution succeeds but does not prove exploitability, it refines the PoC with predefined vulnerability-specific primitive operations.
- The current scope covers five SWC categories: unprotected ether withdrawal, unprotected selfdestruct, reentrancy, transaction order dependence, and randomness from chain attributes.

## Results
- Evaluation uses **264 manually labeled contracts** from SmartBugs: **64** manually constructed contracts and **200** real on-chain contracts.
- V2E identifies **102 of 124 exploitable vulnerabilities**, with **91.9% precision** and **82.3% recall**.
- It removes **71 of 140 false alarms**, which the paper reports as **50.7%**.
- As a post-validation layer for existing tools, V2E reduces false positive rates by **76.9% for Slither**, **56.9% for Mythril**, and **65.0% for Confuzzius**.
- The paper claims V2E outperforms an LLM-based baseline, but the excerpt does not provide the baseline's exact numeric scores.

## Link
- [http://arxiv.org/abs/2604.13611v2](http://arxiv.org/abs/2604.13611v2)