AI-Based Vulnerability Analysis of NFT Smart Contracts
Xin Wang, Xiaoqi Li
TL;DR
The paper addresses the need for scalable AI-based vulnerability detection in NFT smart contracts by compiling a labeled dataset of 16,527 contracts across five vulnerability categories and applying CART-based feature extraction. It then builds a Random Forest with GridSearch hyperparameter tuning to achieve robust detection, aided by visualizations of parameter effects. Key contributions include a detailed vulnerability taxonomy, a CART-to-RF pipeline, and demonstrated improvements over single-tree approaches for all five categories. This work enables automated, scalable NFT contract auditing with practical implications for secure NFT ecosystems.
Abstract
With the rapid growth of the NFT market, the security of smart contracts has become crucial. However, existing AI-based detection models for NFT contract vulnerabilities remain limited due to their complexity, while traditional manual methods are time-consuming and costly. This study proposes an AI-driven approach to detect vulnerabilities in NFT smart contracts. We collected 16,527 public smart contract codes, classifying them into five vulnerability categories: Risky Mutable Proxy, ERC-721 Reentrancy, Unlimited Minting, Missing Requirements, and Public Burn. Python-processed data was structured into training/test sets. Using the CART algorithm with Gini coefficient evaluation, we built initial decision trees for feature extraction. A random forest model was implemented to improve robustness through random data/feature sampling and multitree integration. GridSearch hyperparameter tuning further optimized the model, with 3D visualizations demonstrating parameter impacts on vulnerability detection. Results show the random forest model excels in detecting all five vulnerabilities. For example, it identifies Risky Mutable Proxy by analyzing authorization mechanisms and state modifications, while ERC-721 Reentrancy detection relies on external call locations and lock mechanisms. The ensemble approach effectively reduces single-tree overfitting, with stable performance improvements after parameter tuning. This method provides an efficient technical solution for automated NFT contract detection and lays groundwork for scaling AI applications.