CodeBC: A More Secure Large Language Model for Smart Contract Code Generation in Blockchain

TL;DR

CodeBC tackles the risk of insecure smart-contract code generated by LLMs by introducing a three-stage fine-tuning pipeline: code infilling to adapt LMs to Solidity, vulnerability detection to inject security knowledge, and tags-guided instruction fine-tuning to steer generation toward secure code. The model, evaluated on a Solidity-focused Blockchain-HumanEval suite built from OpenZeppelin and Slither-based datasets, outperforms strong baselines in both code quality (BLEU/CodeBLEU) and security metrics (compilability and vulnerability rate), while reducing reliance on expensive pairwise vulnerability annotations. The results demonstrate a cost-efficient, transferable approach for secure blockchain code generation, with ablations showing additive gains from each stage and transferability analyses indicating competitive performance even in non-Solidity languages when using vulnerability tagging. Overall, CodeBC advances practical secure code generation for smart contracts and provides a dataset and methodology to accelerate future work in this high-stakes domain.

Abstract

Large language models (LLMs) excel at generating code from natural language instructions, yet they often lack an understanding of security vulnerabilities. This limitation makes it difficult for LLMs to avoid security risks in generated code, particularly in high-security programming tasks such as smart contract development for blockchain. Researchers have attempted to enhance the vulnerability awareness of these models by training them to differentiate between vulnerable and fixed code snippets. However, this approach relies heavily on manually labeled vulnerability data, which is only available for popular languages like Python and C++. For low-resource languages like Solidity, used in smart contracts, large-scale annotated datasets are scarce and difficult to obtain. To address this challenge, we introduce CodeBC, a code generation model specifically designed for generating secure smart contracts in blockchain. CodeBC employs a three-stage fine-tuning approach based on CodeLlama, distinguishing itself from previous methods by not relying on pairwise vulnerability location annotations. Instead, it leverages vulnerability and security tags to teach the model the differences between vulnerable and secure code. During the inference phase, the model leverages security tags to generate secure and robust code. Experimental results demonstrate that CodeBC outperforms baseline models in terms of BLEU, CodeBLEU, and compilation pass rates, while significantly reducing vulnerability rates. These findings validate the effectiveness and cost-efficiency of our three-stage fine-tuning strategy, making CodeBC a promising solution for generating secure smart contract code.

Figures (14)

• Figure 1: An example of generative code with smart contract reentrancy attack. The process of reentrancy attack by contract(b) on contract(a):① The attacker initiates a withdrawal request; ② EtherStore responds and automatically calls the fallback() function. ③ The attacker re-initiates the withdrawal request. Since the account balance has not been cleared, the loop can continue.
• Figure 2: General architecture of a language model
• Figure 3: An illustration of the CodeBC model. $(1)$ First fine-tuned the base pre-trained language model on smart contract code. $(2)$ Continued to train the model with the goal of vulnerability detection task on the model with the first smart contract code generation capability. $(3)$ Finally, Tags-guided Instruction Fine-tuning was performed on the models, aligning the vulnerability detection tags in stages $(2)$.
• Figure 4: Schematic structure of the training data in the vulnerability detection task. (a) shows the case where the contract code is vulnerable, (b) shows the case where the contract code is not vulnerable
• Figure 5: Schematic structure of the training data in the tags-guided instruction fine-tuning