Source note
V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution
Smart Contract SecurityVulnerability ValidationExploit GenerationLLM For CodeBlockchain Analysis
Summary
V2E validates reported smart contract vulnerabilities by generating exploit PoCs, executing them, and checking whether they both trigger the bug and produce attacker profit. The paper targets a common failure mode in smart contract scanners: many reports match a vulnerable pattern but are not exploitable in practice.
Problem
- Existing smart contract detection tools often report many false positives because they flag vulnerable code patterns without proving the code can be triggered in a real execution context.
- A triggerable bug may still be irrelevant if it does not cause financial loss or attacker profit, which matters because smart contract attacks are usually profit-driven.
- Manual validation of tool outputs is costly for auditors and developers, especially for state-dependent logic bugs such as reentrancy, transaction ordering, and randomness misuse.
Approach
- V2E takes a vulnerability report, contract source, and function under test, then uses fine-grained static analysis to find likely exploit entry functions through state read/write dependency and access-control analysis.
- It gives the LLM a narrow prompt with the constructor, vulnerability path, and vulnerability features, then asks it to generate a targeted Foundry-based PoC instead of generating an exploit from the full contract without guidance.
- V2E executes each PoC in a customized EVM to check triggerability and profitability. A vulnerability counts as valid only if the PoC both triggers the vulnerable behavior and increases attacker profit or causes financial damage.
- If execution fails, V2E uses execution bytecode plus source mapping to locate the failure point and asks the LLM to revise the PoC. If execution succeeds but does not prove exploitability, it refines the PoC with predefined vulnerability-specific primitive operations.
- The current scope covers five SWC categories: unprotected ether withdrawal, unprotected selfdestruct, reentrancy, transaction order dependence, and randomness from chain attributes.
Results
- Evaluation uses 264 manually labeled contracts from SmartBugs: 64 manually constructed contracts and 200 real on-chain contracts.
- V2E identifies 102 of 124 exploitable vulnerabilities, with 91.9% precision and 82.3% recall.
- It removes 71 of 140 false alarms, which the paper reports as 50.7%.
- As a post-validation layer for existing tools, V2E reduces false positive rates by 76.9% for Slither, 56.9% for Mythril, and 65.0% for Confuzzius.
- The paper claims V2E outperforms an LLM-based baseline, but the excerpt does not provide the baseline's exact numeric scores.