Artificial Intelligence for Security Analysis of Smart Contracts: A Systematic Review

• Lívia Carrera IME
• Raquel C. G. Pinto IME
• Anderson Fernandes Pereira dos Santos IME / Venturus Innovation Center

DOI: https://doi.org/10.5753/webmedia.2026.30821

Resumo

This Systematic Literature Review (SLR) investigates the application of Artificial Intelligence (AI) techniques for smart contract vulnerability detection in Web3 decentralized applications (dApps). Smart contracts enable trustless finance, decentralized governance, and autonomous economic protocols; however, their immutability makes vulnerabilities deployed on-chain difficult to patch without costly governance interventions. Between 2020 and 2024, 127 high-impact attacks caused $2.3 billion in cumulative losses, while state-of-the-art automated tools could have prevented only 8% of them (10 of 127, $149M). Following PRISMA guidelines, records retrieved from IEEE Xplore, the ACM Digital Library, and Springer Link were screened, resulting in 93 primary studies selected for in-depth analysis. The review organizes the literature around three generations of AI-based detection: classical machine learning, deep learning and Graph Neural Networks (GNNs), and Large Language Models (LLMs). The findings show that LLM-based detectors often achieve high recall but limited precision, while GNNs obtain strong results on narrowly scoped economic attacks, such as sandwiching, but still struggle to generalize. Logic-layer and protocol-layer vulnerabilities, which account for a significant share of financial losses, remain insufficiently addressed. The review also highlights emerging directions, including cross-contract reasoning, automated repair, and the security implications of the post-quantum cryptography transition. Persistent challenges include dataset scarcity, limited explainability, weak generalization, and the lack of robust methods for complex cross-contract and protocol-level vulnerabilities. These insights provide guidance for future research toward more accurate, explainable, and comprehensive AI-based security analysis of smart contracts.

Palavras-chave: Smart Contracts, Web3 Security, Vulnerability Detection, Artificial Intelligence, Graph Neural Networks, Large Language Models, Postquantum Cryptography, Systematic Review

Referências

S. J. Alsunaidi, H. Aljamaan, and M. Hammoudeh. 2025. Leveraging Machine Learning Models to Improve Smart Contract Security: A Survey of Vulnerabilities and Detection Methods. Comput. Surveys 58, 6 (2025), Article 151.

M. H. Amin, J. Raymond, D. Kinn, F. Hamze, K. Hamer, J. Pasvolsky,W. Bernoudy, A. D. King, and S. Kortas. 2025. Blockchain with Proof of Quantum Work. arXiv preprint.

Nicola Atzei, Massimo Bartoletti, and Tiziana Cimoli. 2017. A Survey of Attacks on Ethereum Smart Contracts (SoK). In Principles of Security and Trust (POST) (LNCS, Vol. 10204). Springer, 164–186.

Vitalik Buterin. 2014. Ethereum: A Next-Generation Smart Contract and Decentralized Application Platform. [link].

Stefanos Chaliasos, Marcos Antonios Charalambous, Liyi Zhou, Rafaila Galanopoulou, Arthur Gervais, Dimitris Mitropoulos, and Benjamin Livshits. 2024. Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners?. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering (ICSE). ACM, New York, NY, USA, 1–13.

Chao Chen, Jiachi Su, Jintao Chen, Yanlin Wang, Ting Bi, Jing Yu, Yizhou Wang, Xin Lin, Ting Chen, and Zibin Zheng. 2025. When ChatGPT Meets Smart Contract Vulnerability Detection: How Far Are We? ACM Transactions on Software Engineering and Methodology 34, 4 (2025), Article 100.

Weili Chen, Zibin Zheng, Edith Ngai, Peilin Zheng, and Yuren Zhou. 2019. Exploiting Blockchain Data to Detect Smart Ponzi Schemes on Ethereum. IEEE Access 7 (2019), 37575–37586.

DeepSeek-AI. 2024. DeepSeek LLM: Scaling Open-Source Language Models with Longtermism. arXiv preprint.

David L. Dill, Wolfgang Grieskamp, Junkil Park, Shaz Qadeer, Meng Xu, and Emma Zhong. 2022. Fast and Reliable Formal Verification of Smart Contracts with the Move Prover. In Tools and Algorithms for the Construction and Analysis of Systems. Springer, Munich, Germany, 183–200.

Ethereum Foundation. 2024. Quantum Resistance. Accessed: 2024-11-15. [link]

Chao Gao, W. Yang, J. Ye, Y. Xue, and J. Sun. 2024. sGuard+: Machine Learning Guided Rule-Based Automated Vulnerability Repair on Smart Contracts. ACM Transactions on Software Engineering and Methodology 33, 5 (2024), Article 114.

W. Haouari, A. S. Hafid, and M. Fokaefs. 2024. Vulnerabilities of Smart Contracts and Mitigation Schemes: A Comprehensive Survey. arXiv preprint arXiv:2403.19805.

Y. He, H. Dong, H. Wu, and Q. Duan. 2023. Formal Analysis of Reentrancy Vulnerabilities in Smart Contract Based on CPN. Electronics 12, 10 (2023), 2152.

B. Hu, Z. Zhang, J. Liu, Y. Liu, J. Yin, R. Lu, and X. Lin. 2021. A Comprehensive Survey on Smart Contract Construction and Execution: Paradigms, Tools, and Systems. Patterns 2, 2 (2021), 100179.

International Organization for Standardization. 2018. ISO 31000:2018 — Risk Management: Guidelines. ISO, Geneva, Switzerland.

N. Ivanov, C. Li, Q. Yan, Z. Sun, Z. Cao, and X. Luo. 2023. Security Defense for Smart Contracts: A Comprehensive Survey. Comput. Surveys 55, 14s (2023), 1–37.

B. Kitchenham and S. Charters. 2007. Guidelines for Performing Systematic Literature Reviews in Software Engineering. Technical Report EBSE-2007-01. Keele University.

Ziqiao Kong, Cen Zhang, Maoyi Xie, Ming Hu, Yue Xue, Ye Liu, Haijun Wang, and Yang Liu. 2025. Smart Contract Fuzzing Towards Profitable Vulnerabilities. Proceedings of the ACM on Software Engineering 2, FSE (2025), 23.

X. Liu, T. Huang, C. Tan, J. Huang, Q. Wang, and Y. Pang. 2025. CrossMiner: Smart Contract Vulnerability Detection in Interactive Scenarios. In Proc. IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, Piscataway, NJ, USA, 1724–1731. 618 WebMedia’2026, Lavras/MG, Brazil Carrera et al.

Zhenguang Liu, Peng Qian, Xiaoyang Wang, Yuan Zhuang, Lin Qiu, and Xun Wang. 2023. Combining Graph Neural Networks with Expert Knowledge for Smart Contract Vulnerability Detection. IEEE Transactions on Knowledge and Data Engineering 35, 2 (2023), 1296–1310.

Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena, and Aquinas Hobor. 2016. Making Smart Contracts Smarter. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 254–269.

S. Meisami and W. E. Bodell. 2023. A Comprehensive Survey of Upgradeable Smart Contract Patterns. arXiv preprint.

M. Milo, E. H. Nielsen, D. Annenkov, and B. Spitters. 2022. Finding Smart Contract Vulnerabilities with ConCert’s Property-Based Testing Framework. arXiv preprint arXiv:2208.00758.

P. Momeni, Y. Wang, and R. Samavi. 2019. Machine Learning Model for Smart Contracts Security Analysis. In Proc. International Conference on Privacy, Security and Trust (PST). IEEE, Piscataway, NJ, USA, 1–6.

Satoshi Nakamoto. 2008. Bitcoin: A Peer-to-Peer Electronic Cash System. White paper.

National Institute of Standards and Technology. 2024. Post-Quantum Cryptography Standardization. Accessed: 2024-11-15. [link]

Matthew J. Page, Joanne E. McKenzie, Patrick M. Bossuyt, Isabelle Boutron, Tammy C. Hoffmann, CynthiaD. Mulrow, et al. 2021. The PRISMA 2020 Statement: An Updated Guideline for Reporting Systematic Reviews. BMJ 372 (2021), n71.

Parsifal. [n. d.]. About Parsifal: Perform Systematic Literature Reviews. [link]. Accessed: 2026-06-12.

Daniel Perez and Benjamin Livshits. 2021. Smart Contract Vulnerabilities: Vulnerable Does Not Imply Exploited. In Proc. USENIX Security Symposium. USENIX Association, Berkeley, CA, USA, 1325–1341.

P. Qian, Z. Liu, Q. He, B. Huang, D. Tian, and X. Wang. 2022. Smart Contract Vulnerability Detection Technique: A Survey. arXiv preprint.

N. F. Samreen and M. H. Alalfi. 2021. A Survey of Security Vulnerabilities in Ethereum Smart Contracts. CoRR, abs/2105.06974.

Y. Sun, D. Wu, Y. Xue, H. Liu, H. Wang, Z. Xu, X. Xie, and Y. Liu. 2024. GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis. Proc. IEEE/ACM International Conference on Software Engineering (ICSE).

P. Swathi and D. Boscovic. 2022. A Survey on Quantum-Safe Blockchain System. Proc. Annual Computer Security Applications Conference (ACSAC), ACM.

Nick Szabo. 1994. Smart Contracts. Unpublished manuscript.

Gavin Wood. 2014. Ethereum: A Secure Decentralised Generalised Transaction Ledger. Ethereum Project Yellow Paper 151 (2014), 1–32.

C. Wu, L. Chen, K. Wang, W. Han, and H. Chai. 2025. SandWatch: Towards Detecting Sandwich Attacks in Ethereum Using a Dual-Task Graph Neural Network. ACM Transactions on the Web.

H.Wu, Q. Yao, Z. Liu, B. Huang, Y. Zhuang, H. Tang, and E. Liu. 2024. Blockchain for Finance: A Survey. IET Blockchain.

Meihua Xiao, Yangping Xu, Zehuan Li, and Hongbin Wan. 2024. Advanced Security Auditing Methods for Solidity-Based Smart Contracts. Electronics 13, 20 (2024), 4093. DOI: 10.3390/electronics13204093

S. Yang, J. Niu, and Y. Zhang. 2024. SoK: AI-Powered Security Analysis of Smart Contract. In Proc. International Conference on Meta Computing (ICMC). IEEE, Piscataway, NJ, USA, 91–98.

L. Zhang, J. Wang, W. Wang, Z. Jin, Y. Su, and H. Chen. 2022. SmartBERT: Vulnerability Detection for Smart Contracts via Pre-Training. arXiv preprint.

Z. Zheng, S. Xie, H.-N. Dai, W. Chen, X. Chen, J. Weng, and M. Imran. 2019. An Overview on Smart Contracts: Challenges, Advances and Platforms. Future Generation Computer Systems 105 (2019), 475–491.

L. Zhou, X. Xiong, J. Ernstberger, S. Chaliasos, Z. Wang, Y. Wang, K. Qin, R. Wattenhofer, D. Song, and A. Gervais. 2023. SoK: Decentralized Finance (DeFi) Attacks. Proc. IEEE Symposium on Security and Privacy (S&P).