Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LibScan: Smart Contract Library Misuse Detection with Iterative Feedback and Static Verification

Yishun Wang, Wenkai Li, Xiaoqi Li, Zongwei Li, Lei Xie, Yuqing Zhang

Abstract

Smart contracts are self-executing programs that manage financial transactions on blockchain networks. Developers commonly rely on third-party code libraries to improve both efficiency and security. However, improper use of these libraries can introduce hidden vulnerabilities that are difficult to detect, leading to significant financial losses. Existing automated tools struggle to identify such misuse because it often requires understanding the developer's intent rather than simply scanning for known code patterns. This paper presents LibScan, an automated detection framework that combines large language model (LLM)-based semantic reasoning with rule-based code analysis, identifying eight distinct categories of library misuse in smart contracts. To improve detection reliability, the framework incorporates an iterative self-correction mechanism that refines its analysis across multiple rounds, alongside a structured knowledge base derived from large-scale empirical studies of real-world misuse cases. Experiments conducted on 662 real-world smart contracts demonstrate that LibScan achieves an overall detection accuracy of 85.15\%, outperforming existing tools by a margin of over 16 percentage points. Ablation experiments further confirm that combining both analysis approaches yields substantially better results than either method used independently.

LibScan: Smart Contract Library Misuse Detection with Iterative Feedback and Static Verification

Abstract

Smart contracts are self-executing programs that manage financial transactions on blockchain networks. Developers commonly rely on third-party code libraries to improve both efficiency and security. However, improper use of these libraries can introduce hidden vulnerabilities that are difficult to detect, leading to significant financial losses. Existing automated tools struggle to identify such misuse because it often requires understanding the developer's intent rather than simply scanning for known code patterns. This paper presents LibScan, an automated detection framework that combines large language model (LLM)-based semantic reasoning with rule-based code analysis, identifying eight distinct categories of library misuse in smart contracts. To improve detection reliability, the framework incorporates an iterative self-correction mechanism that refines its analysis across multiple rounds, alongside a structured knowledge base derived from large-scale empirical studies of real-world misuse cases. Experiments conducted on 662 real-world smart contracts demonstrate that LibScan achieves an overall detection accuracy of 85.15\%, outperforming existing tools by a margin of over 16 percentage points. Ablation experiments further confirm that combining both analysis approaches yields substantially better results than either method used independently.

Paper Structure

This paper contains 26 sections, 3 equations, 4 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Ethereum and Smart Contracts
  4. Solidity Library
  5. Library Misuse
  6. Preliminaries
  7. P1: Invalid Wrapper Check in Library
  8. P2: Unhandled Exceptions in Library
  9. P3: Inappropriate Library Extension
  10. P4: Inappropriate Using For
  11. P5: Incomplete Function Replacement
  12. P6: Overestimated Library Capability
  13. P7: Underestimated Library Capability
  14. P8: Unnecessary Library Using
  15. Methodology
  16. ...and 11 more sections

Figures (4)

  • Figure 1: Overall architecture of LibScan, a hybrid framework for smart contract library misuse detection. LibScan combines dual heterogeneous LLM-based semantic reasoning with static analysis and a loop feedback optimization mechanism to reconcile inconsistent results, suppress hallucinations, and incrementally update a pattern-aware knowledge base derived from empirical misuse studies.
  • Figure 2: Prompt for Logic and Snippets Matching
  • Figure 3: Workflow of the Loop Feedback Iterative Optimization Algorithm.
  • Figure 4: Four Models' Evaluation Metrics after Iteration