AI pinpoints and explains smart contract flaws at function level

Smart contracts are computer programs that run on blockchains and execute agreements automatically, much like a vending machine that releases a product once payment is made. They now power cryptocurrency payments, online lending and exchange services, digital collectibles, and more, often holding large sums of money directly. Their critical weakness is that once deployed, the code cannot be changed: a single programming mistake becomes a permanent opening for attackers, and stolen funds are rarely recovered. A research team led by Professor Le-Minh Nguyen and doctoral student Ngoc-Minh Nguyen at the Japan Advanced Institute of Science and Technology (JAIST) has developed a unified framework that detects and explains smart contract vulnerabilities. Instead of flagging an entire program as risky, the system shows where the flaw is, why it is dangerous, and how to fix it. The study was made available online in ACM Transactions on Software Engineering and Methodology on September 16, 2026.

The framework addresses three long-standing limits of automated detection tools. Many existing tools judge only whether a whole contract looks risky, leaving developers to hunt for the faulty part by hand. Most return terse warnings with no explanation of why the code is dangerous or how to fix it. And there has been no large dataset labeling flaws at the level of individual functions, the building blocks developers actually write and review. The JAIST framework has three parts. First, the team built a tool that automatically inserts realistic flaws into real contracts, producing a publicly available dataset of 4,208 contracts and more than 118,000 functions across eight vulnerability types. Second, they designed a graph neural network, HCA-SGNN, that represents each contract as a network of connected code elements and analyzes each function individually while also modeling how functions interact, which is key for attacks such as reentrancy that exploit several functions at once. This allows the model to locate exactly where a vulnerability lies rather than simply labeling the whole contract as unsafe. Third, large language models generate structured reports describing each flaw’s type, location, cause, impact, and fix.

The graph neural network examines each contract in two ways at once. An across-functions view uses the links between functions, so it can notice dangers that arise when functions work together, while an inside-each-function view ignores those links and examines each function in detail. The two results are combined, and the model learns how much to rely on each view, repeating this process several times before each function is compared with the others to decide which one contains a flaw. Separating the two views improved function-level accuracy, measured as F1, by 23.6 points. The explanation abilities of large language models were then distilled into compact models that run on ordinary hardware.

On 242 real-world contracts, HCA-SGNN outperformed existing detection methods and general-purpose language models fine-tuned for the same task. It also detected several vulnerability types absent from its training data. The compact explanation models achieved about 97–98% of the quality of large commercial models. The researchers see applications in pre-release security audits, developer tools, and faster, lower-cost reviews for blockchain-based financial services. “For AI to be truly useful in security, people need to understand why it raises an alarm. Our system points to the exact part of a program that is dangerous and explains the risk in plain language. We believe this kind of explainable AI is key to building software that people can trust,” concludes Prof. Nguyen. The work is a computational simulation and modeling study; the reported performance figures come from the team’s own benchmarks and dataset, and real-world audit outcomes will depend on how the framework is applied in practice.

Subject of Research: Function-level AI detection and explanation of smart contract vulnerabilities

Article Title: Where's the bug? AI pinpoints and explains flaws in smart contracts

Article References: Where's the bug? AI pinpoints and explains flaws in smart contracts. Original publication (Bibliographic details unavailable.)

Image Credits: AI Generated

DOI: Not provided

Keywords: smart contracts, blockchain security, vulnerability detection, graph neural network, explainable AI, large language models, reentrancy, software engineering, code auditing, JAIST, machine learning, ACM Transactions on Software Engineering and Methodology