Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing

2026-07-24

AI Summary

This study addresses the challenge of detecting vulnerabilities such as reentrancy and integer overflow in Ethereum NFT smart contracts, which are particularly susceptible due to their complex logic and the limitations of existing static analysis tools in balancing efficiency and precision. To overcome this, the authors propose a novel detection approach that integrates domain-knowledge guidance, precise code slicing, and structured reasoning powered by large language models. Specifically, they construct a knowledge base grounded in the ERC-721 standard, employ regular-expression-driven, vulnerability-oriented code slicing, and apply a constrained DeepSeek model for rule-based analysis. Evaluated on 450 real-world NFT contracts, the method achieves a true positive rate of 97.1%, substantially outperforming variants without the knowledge base (87.11%) or unguided full-contract analysis (73.78%), thereby demonstrating its effectiveness and innovation.

Abstract

Ethereum non-fungible tokens (NFTs) implement ownership, transfer, authorization, and metadata operations through smart contracts, making contract vulnerabilities a direct risk to digital assets. Existing static analyzers provide efficient rule-based screening but can struggle with application-specific logic, whereas unconstrained large language model analysis may be distracted by irrelevant code or produce inconsistent outputs. We present a vulnerability-detection method that combines vulnerability-focused code slicing, an ERC-721-oriented knowledge base, and constrained DeepSeek analysis. Regular-expression patterns locate candidate statements for reentrancy, integer overflow or underflow, and timestamp dependence. A structure-aware context-window algorithm then extracts line-numbered code slices. DeepSeek analyzes each slice using explicit decision rules and a fixed output schema, and the resulting records support automated batch processing. On 450 NFT contract samples, the full configuration produced 437 positive labels, corresponding to a reported positive-label rate of 97.1%. Removing the external knowledge base reduced this rate to 87.11%, while analyzing complete contracts without the knowledge base reduced it to 73.78%. These results indicate that focused code context and domain constraints materially affect the detector's reported output.

Problem

• Ethereum NFT
• smart contract vulnerability
• code slicing
• large language model
• static analysis

Innovation

• code slicing
• knowledge-guided
• large language model
• smart contract vulnerability
• ERC-721