English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Smart contracts are prone to various vulnerabilities, leading to substantialfinancial losses over time. Current analysis tools mainly targetvulnerabilities with fixed control or data-flow patterns, such as re-entrancyand integer overflow. However, a recent study on Web3 security bugs revealedthat about 80% of these bugs cannot be audited by existing tools due to thelack of domain-specific property description and checking. Given recentadvances in Large Language Models (LLMs), it is worth exploring how GenerativePre-training Transformer (GPT) could aid in detecting logicc vulnerabilities.  In this paper, we propose GPTScan, the first tool combining GPT with staticanalysis for smart contract logic vulnerability detection. Instead of relyingsolely on GPT to identify vulnerabilities, which can lead to high falsepositives and is limited by GPT's pre-trained knowledge, we utilize GPT as aversatile code understanding tool. By breaking down each logic vulnerabilitytype into scenarios and properties, GPTScan matches candidate vulnerabilitieswith GPT. To enhance accuracy, GPTScan further instructs GPT to intelligentlyrecognize key variables and statements, which are then validated by staticconfirmation. Evaluation on diverse datasets with around 400 contract projectsand 3K Solidity files shows that GPTScan achieves high precision (over 90%) fortoken contracts and acceptable precision (57.14%) for large projects likeWeb3Bugs. It effectively detects ground-truth logic vulnerabilities with arecall of over 70%, including 9 new vulnerabilities missed by human auditors.GPTScan is fast and cost-effective, taking an average of 14.39 seconds and 0.01USD to scan per thousand lines of Solidity code. Moreover, static confirmationhelps GPTScan reduce two-thirds of false positives.

GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis