AI pinpoints and explains bugs and flaws in smart contracts
Smart contracts are computer programs that run on blockchains and carry out agreements automatically, like a vending machine that releases a product once payment is made. Today they power cryptocurrency payments, online lending and exchange services, digital collectibles and more, often holding large sums of money directly.
But smart contracts have a critical weakness: Once deployed, their code cannot be changed. A single programming mistake becomes a permanent opening for attackers, and stolen funds are rarely recovered.
Automated tools exist to catch such flaws before release, but they have important limits. Many judge only whether an entire contract looks risky, leaving developers to hunt for the faulty part by hand. Most return terse warnings with no explanation of why the code is dangerous or how to fix it. And there has been no large data set labeling flaws at the level of individual functions, the building blocks developers actually write and review.
To address these problems, a research team led by professor Le-Minh Nguyen and doctoral student Ngoc-Minh Nguyen from the Japan Advanced Institute of Science and Technology (JAIST) developed a unified framework for detecting and explaining smart contract vulnerabilities.
Their study was published in ACM Transactions on Software Engineering and Methodology on Sept. 15, 2026.
From injected flaws to plain-language reports
The framework has three parts. First, the team built a tool that automatically inserts realistic flaws into real contracts, producing a publicly available data set of 4,208 contracts and more than 118,000 functions across eight vulnerability types.
Second, they designed a graph neural network, HCA-SGNN, that represents each contract as a network of connected code elements and analyzes each function individually while also modeling how functions interact, which is key for attacks such as reentrancy that exploit several functions at once. This allows the model to locate exactly where a vulnerability lies, rather than simply labeling the whole contract as unsafe.
Third, large language models generate structured reports describing each flaw’s type, location, cause, impact and fix. These abilities were then distilled into compact models that run on ordinary hardware.
Strong results on real-world contracts
On 242 real-world contracts, HCA-SGNN outperformed existing detection methods and general-purpose language models fine-tuned for the same task. It also detected several vulnerability types absent from its training data. The compact explanation models achieved about 97%–98% of the quality of large commercial models.
The researchers see applications in prerelease security audits, developer tools and faster, lower-cost reviews for blockchain-based financial services. “For AI to be truly useful in security, people need to understand why it raises an alarm. Our system points to the exact part of a program that is dangerous and explains the risk in plain language. We believe this kind of explainable AI is key to building software that people can trust,” concludes professor Nguyen.
Image credit: Morthy Jameson from Pexels
(Tech Explore)