Chiral Analysis of Smart Contracts: Detecting Vulnerabilities from Relational Inconsistencies Across Business Paths

2026-07-20

AI Summary

This work addresses the challenge of detecting subtle vulnerabilities in smart contracts arising from semantic inconsistencies between paired business logic paths—such as single vs. batch operations or buy vs. sell transactions—which often evade existing analysis tools. The paper introduces “chiral analysis,” a novel approach that adapts relational specification principles to smart contract security by formally modeling symmetries across guard conditions, state transitions, value flows, and failure behaviors between path pairs. Integrated with large language models for semantic filtering, this method precisely identifies cross-path logical flaws while maintaining computational efficiency. Evaluation on the Phi protocol uncovered 13 previously unknown and distinct vulnerabilities—including Merkle proof reuse and fee unit mismatches—from 3,217 path pairs, demonstrating the technique’s effectiveness and practical utility.

Abstract

Smart-contract vulnerabilities often arise from inconsistencies between business paths that should correspond to one another, such as single and batch entry points, direct and adapter-based flows, quote and execution paths, or inverse operations such as buy and sell. Existing analyzers are effective for many local syntactic and data-flow patterns, but they provide limited support for bugs whose oracle is relational: whether two semantically paired paths preserve compatible guards, state transitions, value flows, and failure behavior. This paper introduces chiral analysis, a relational model that treats paired business paths as implicit specifications for each other. We formalize chiral relations as static analogues of metamorphic relations, derive obligations over guards, actors, state, value, ordering, failure behavior, and external interactions, and report a vulnerability when a violated obligation has security impact. We implement this idea in ChiralDetector, a Solidity prototype that extracts business paths, ranks candidate pairs with static facts, applies LLM-based semantic filtering and detection, and validates and deduplicates findings. In a preliminary evaluation on the Phi protocol, ChiralDetector reduced 3,217 statically ranked path pairs to 1,643 semantic candidates, produced 101 deduplicated finding groups, and retained 44 strict-validator positives that manually collapsed to 13 effective unique issues. These include cross-art Merkle proof reuse, fee unit mismatches, public state-tracking helpers, and refund propagation gaps. The results suggest that chiral analysis can expose business-logic bug classes that are difficult to express as single-function rules while providing a structured way to control LLM cost and validator precision.

Problem

• smart contracts
• vulnerability detection
• relational inconsistency
• business logic
• chiral analysis

Innovation

• chiral analysis
• relational inconsistency
• smart contract vulnerability
• business logic bug
• metamorphic relations