Trace: Securing Smart Contract Repository Against Access Control Vulnerability

TL;DR

This work addresses securing non-compilable smart-contract repositories from Access Control vulnerabilities by introducing TRACE, a pipeline that uses LLMs to locate sensitive functions and to complete them into compilable contracts, enabling targeted static analysis. TRACE constructs a function call graph enriched with function-level CFGs and applies a multi-step vulnerability detection process that focuses on permission checks and risky actions, without relying on full repository compilation. Evaluations across CVE datasets, large on-chain sets, and real-world repositories show TRACE outperforms state-of-the-art tools in recall and precision (e.g., 93% recall on CVEs, 89.2% precision on-chain, 87.0% precision on repositories), demonstrating the effectiveness of combining LLM-assisted code understanding with static analysis. The approach broadens security auditing capabilities for developers and researchers, enabling robust vulnerability analysis in complex, non-compilable codebases and highlighting practical implications for secure code reuse in the evolving smart-contract ecosystem.

Abstract

Smart contract vulnerabilities, particularly improper Access Control that allows unauthorized execution of restricted functions, have caused billions of dollars in losses. GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files-these serve as intermediate development artifacts that must be compiled and packaged before deployment. Third-party developers often reference, reuse, or fork code from these repositories during custom development. However, if the referenced code contains vulnerabilities, it can introduce significant security risks. Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories, as they typically require the target contract to be compilable to generate an abstract representation for further analysis. This paper presents TRACE, a tool designed to secure non-compilable smart contract repositories against access control vulnerabilities. TRACE employs LLMs to locate sensitive functions involving critical operations (e.g., transfer) within the contract and subsequently completes function snippets into a fully compilable contract. TRACE constructs a function call graph from the abstract syntax tree (AST) of the completed contract. It uses the control flow graph (CFG) of each function as node information. The nodes of the sensitive functions are then analyzed to detect Access Control vulnerabilities. Experimental results demonstrate that TRACE outperforms state-of-the-art tools on an open-sourced CVE dataset, detecting 14 out of 15 CVEs. In addition, it achieves 89.2% precision on 5,000 recent on-chain contracts, far exceeding the best existing tool at 76.9%. On 83 real-world repositories, TRACE achieves 87.0% precision, significantly surpassing DeepSeek-R1's 14.3%.

Figures (7)

• Figure 1: The process of compiling, auditing, and forking a smart contract repository.
• Figure 2: An example of Access Control vulnerability.
• Figure 3: The overview of Trace.
• Figure 4: Prompt template of sensitive function location.
• Figure 5: Prompt template of function snippet completion.