OrchestralSec: A Hybrid and Explainable Framework for Solidity Smart Contract Security

• Guilherme A. Soares Unioeste
• João L. D. S. Filho UFC
• Nicholas P. Fontanini Unicamp
• Bruno Evaristo CPQD

DOI: https://doi.org/10.5753/wblockchain.2026.22966

Abstract

Smart contracts manage high-value digital assets, but security flaws frequently result in irreversible financial losses. Although several automated auditing tools exist, their isolated execution often yields high rates of false positives and false negatives. This paper proposes and evaluates a unified framework for auditing Solidity smart contracts, combining static analysis (Slither), symbolic execution (Mythril), and dynamic testing (Foundry). The architecture orchestrates tool execution, unifies heterogeneous outputs using the SARIF standard, and leverages a Large Language Model (LLM) to translate raw logs into contextual, explainable reports. Evaluated on a curated dataset of 53 contracts from the SmartBugs repository, the proposed framework achieved an F1-Score of 92.93%, substantially outperforming the isolated performance of Slither (72.28%) and Mythril (88.42%). The results demonstrate that hybrid orchestration mitigates the structural limitations of individual engines, reduces the auditor’s cognitive load, and consolidates a robust platform for secure development in the Web3 ecosystem.

References

Alchini, C. A. (2025). Análise de ameaças e vulnerabilidades em blockchains permissionadas. Trabalho de conclusão de curso (graduação), Universidade Federal de Santa Catarina, Florianópolis.

Atzei, N., Bartoletti, M., and Cimoli, T. (2017). A survey of attacks on ethereum smart contracts (sok). In Principles of Security and Trust: 6th International Conference, POST 2017, pages 164–186. Springer.

Braga, A. M., Marino, F. C. H., and dos Santos, R. R. (2017). Segurança de aplicações blockchain além das criptomoedas. In Anais do XVII Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais (SBSeg 2017), chapter 3. SBC, Brasília. Minicursos.

Carrera, L., Cordeiro, R., and Abelém, A. (2025). Auditai: Automatizando e facilitando a auditoria de contratos inteligentes com relatórios contextuais gerados por ia. In Anais do VII Workshop em Blockchain: Teoria, Tecnologias e Aplicações, pages 140–153, Porto Alegre, RS, Brasil. SBC.

Chen, C., Su, J., Chen, J., Wang, Y., Bi, T., Yu, J., Wang, Y., Lin, X., Chen, T., and Zheng, Z. (2025). When chatgpt meets smart contract vulnerability detection: How far are we? ACM Transactions on Software Engineering and Methodology, 34(4):100.

ConsenSys Diligence (2024). Mythril: Security analysis tool for evm bytecode. [link]. Acessado em: 04 fev. 2026.

Durieux, T., Ferreira, J. F., Abreu, R., and Cruz, P. (2020). Empirical review of automated analysis tools on 47,587 ethereum smart contracts. In Proceedings of the 42nd International Conference on Software Engineering (ICSE ’20), pages 530–541. ACM.

Feist, J., Grieco, G., and Groce, A. (2019). Slither: A static analysis framework for smart contracts. In 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB), pages 8–15. IEEE.

Ferreira, J. F., Cruz, P., Durieux, T., and Abreu, R. (2020). Smartbugs: A framework to analyze solidity smart contracts. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering, pages 1349–1352.

Fonseca, F. M., Silva, P. H. G., Mendonça, D., and Moura, M. d. S. (2025). Towards the evolution of tools for detecting vulnerabilities in smart contracts: A case study of mythril and slither. In Anais do Workshop em Blockchain: Teoria, Tecnologias e Aplicações (WBlockchain). SBC.

Foundry Contributors (2024). Foundry: Blazing fast, portable and modular toolkit for ethereum application development. [link]. Acessado em: 05 fev. 2026.

Li, P., Li, S., Ding, M., Yu, J., Zhang, H., Zhou, X., and Li, J. (2022). A vulnerability detection framework for hyperledger fabric smart contracts based on dynamic and static analysis. In Proceedings of the 26th International Conference on Evaluation and Assessment in Software Engineering (EASE ’22), pages 366–374, New York, NY, USA. ACM.

Mueller, B. (2018). Mythril: Security analysis tool for ethereum smart contracts. [link].

Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. Acessado em: 28 jan. 2026.

Roziere, B., Gehring, J., Gloeckle, F., Sootla, S., Gat, I., Tan, X. E., Adi, Y., Liu, J., Remez, T., Rapin, J., et al. (2023). Code llama: Open foundation models for code. arXiv preprint arXiv:2308.12950.

Standard, O. (2020). Static analysis results interchange format (sarif) version 2.1.0. Technical report, OASIS Open.

U.S. Securities and Exchange Commission (2017). Report of investigation pursuant to section 21(a) of the securities exchange act of 1934: The dao. [link]. Release No. 81207. Acessado em: 28 jan. 2026.

Vogelgesang, T. et al. (2020). Smart contract weakness classification and test cases. IEEE Standard for Smart Contract Security.

Zhang, C., Dou, F., and Li, X. (2025). Dos attacks and defense technologies in blockchain systems: A hierarchical analysis. arXiv preprint arXiv:2507.22611.