cs.CR提交于 2026-10-26已译

超越复制：通过协议变异构建终身智能合约安全任务

Beyond Copying: Lifelong Smart Contract Security Task Construction via Protocol Mutation

Zifan Peng · Peng Huang · Jingyi Zheng · Yingjie Xue · Xuechao Wang · Xinlei He · et al.

中文摘要

AI agent 可通过检查代码和运行测试来辅助智能合约安全，但现有评测可能奖励记忆或复制答案，包括从公开区块链交易中恢复的攻击代码，重构合约与验证任务还需高昂人工成本。CONSTRAINTDIAL 是基于协议变异的智能合约安全任务终身构建框架，可自动完成本地合约重构，并利用攻击执行结果选择对必需调用或输入的修改。执行检查指导修订，使原攻击失败，同时保留可利用性、安全目标与正常功能；新事件和审计发现也采用同一流程。该框架从 203 个公开案例构建了 3,045 个任务输入，覆盖检测、利用和修复。相比仅重构，协议变异使用公开答案时的成功率在三类任务上平均下降 10.9 个百分点，靠复制在线答案解决的任务比例下降 9.3 个百分点。

关键要点

01现有智能合约安全评测可能奖励记忆或复制公开攻击答案。
02CONSTRAINTDIAL 自动重构合约，并通过攻击执行筛选协议变异。
03修订须使原攻击失败，同时保留可利用性、安全目标和正常功能。
04框架从 203 个公开案例构建 3,045 个检测、利用与修复任务输入。
05协议变异使公开答案成功率平均下降 10.9 个百分点，复制解题比例下降 9.3 个百分点。

解读

尚无解读。

原始英文摘要

arXiv:2610.32453v1 Announce Type: cross Abstract: AI agents can inspect code and run tests to support smart contract security. SlowMist reports about $38.6 billion in losses across the broader blockchain ecosystem. Existing evaluations can reward memorized or copied answers, including attack code recovered from public blockchain transactions. Reconstructing contracts and validating tasks also require costly manual effort. To address these issues, we propose CONSTRAINTDIAL, a framework for lifelong construction of smart contract security tasks via protocol mutation. It automates local contract reconstruction and uses attack execution to select changes to the required calls or inputs. Execution checks guide revisions that make the original attack fail while preserving exploitability, the security objective, and normal functionality. New incidents and audit findings enter the same procedure. With CONSTRAINTDIAL, we construct 3,045 task inputs from 203 public cases, covering detect, exploit, and patch. Compared with reconstruction alone, protocol mutation reduces success with supplied public answers by 10.9 percentage points on average across detect, exploit, and patch. The fraction of tasks solved by copying online answers falls by 9.3 points.