LLMs Inject Vulnerabilities in Smart Contracts
Automated Vulnerability Injection in Smart Contracts Using Large Language Models
The method creates valuable test datasets for security tools, helping developers in ASEAN's growing blockchain ecosystem improve smart contract safety.
Researchers used Large Language Models to automatically inject vulnerabilities into Solidity smart contracts. The approach targeted 49 vulnerability types from OpenSCV and generated nearly 1,000 candidate variants. After validation, 32 confirmed vulnerable contracts spanning 25 vulnerability types survived, achieving a 16.58% survival rate. The study revealed that LLM-based vulnerability injection is feasible but has limitations in scalability and diversity.
Automated Vulnerability Injection in Smart Contracts Using Large Language Models
Assessing vulnerability detection tools for smart contracts requires datasets with known ground truth, yet such datasets are scarce and difficult to build by hand. We propose an approach that uses Large Language Models (LLMs) to automatically inject vulnerabilities into Solidity smart contracts, and demonstrate it in a case study targeting 49 vulnerability types from OpenSCV. Injected contracts are validated through a multi-step pipeline checking compilation, execution, business logic, and the presence of the intended vulnerability. Applied to real-world contracts from SmartBugs, LLMs generate nearly 1,000 candidate variants; after deduplication and validation, 32 confirmed vulnerable contracts spanning 25 vulnerability types survive (a 16.58% survival rate). Surviving contracts concentrate in structurally simpler targets and vulnerability types with localized syntactic patterns. We report practical challenges including LLMs' non-determinism and the difficulty of preserving contract semantics. We then use the validated contracts to assess three static analyzers, revealing complementary and incomplete coverage profiles. Results show that LLM-based vulnerability injection is feasible, while exposing key limitations in scalability and diversity.
