Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts

2026-07-17

AI Summary

This work addresses the limitations of existing smart contract security tools, which predominantly focus on vulnerability detection while struggling to assess exploitability and real-world impact. To bridge this gap, the paper introduces KASS, a novel framework that, for the first time, enables automatic synthesis and semantic interpretation of executable attack chains from identified vulnerabilities. KASS employs a knowledge-enhanced multi-agent architecture, decomposing attack generation into three stages—planning, generation, and testing—through retrieval-augmented planning, formalized generation constraints, and a two-tier progressive repair mechanism. Evaluated on 104 contracts from SmartBugs-Curated, KASS successfully generates executable attacks for 94.23% of them and validates nine exploits on eleven real-world CVE-affected contracts, significantly outperforming baseline methods such as REX, AdvSCanner, and Claude Code.

Abstract

Smart contract vulnerabilities pose severe financial risks, yet existing security tools largely stop at vulnerability detection, offering limited support for explaining whether reported flaws are exploitable, how attacks unfold, and what concrete damage they cause. To bridge this gap, we propose KASS (Knowledge-Augmented Attack Synthesis and Simulation), a multi-agent framework for executable smart contract exploit verification. KASS decomposes automated exploit generation into planning, generation, and testing stages, and integrates three complementary mechanisms: retrieval-augmented planning over real-world audit knowledge, formal generation and validation constraints that bind attack plans to executable proof-of-concept tests, and a hierarchical dual-loop refinement process that repairs code-level errors while triggering strategy-level replanning when attack assumptions fail. We evaluate KASS on 104 SmartBugs-Curated contracts across four vulnerability categories. Experimental results show that KASS successfully generates executable exploits for 94.23% of tested contracts; this rate is higher than previously reported results for REX and AdvSCanner on comparable SmartBugs-Curated subsets, and higher than our reproduced Claude Code baseline under the same evaluation protocol. On 11 real-world CVE-tagged contracts, KASS successfully validates 9 cases. Beyond exploit generation, KASS produces structured attack plans that document exploitation flows, quantify potential asset losses, and serve as semantic false positive filters for static analysis tools.

Problem

• smart contract vulnerabilities
• exploit verification
• attack simulation
• security analysis
• executable exploits

Innovation

• multi-agent framework
• attack synthesis
• retrieval-augmented planning
• executable exploit generation
• hierarchical dual-loop refinement