LibScan: Smart Contract Library Misuse Detection with Iterative Feedback and Static Verification

1. Problem Statement

Smart contracts are critical infrastructure for decentralized finance (DeFi), yet they are prone to severe vulnerabilities. While developers increasingly rely on third-party Solidity libraries (e.g., SafeERC20, SafeMath) to improve efficiency and security, library misuse remains a significant, under-addressed threat.

• The Core Issue: Improper use of libraries (e.g., incorrect function calls, misunderstanding capabilities, or unnecessary usage) introduces hidden vulnerabilities that are difficult to detect.
• Limitations of Existing Tools:
  • Traditional Static Analysis (e.g., Slither, Smartbugs): Relies on hard-coded rules, Abstract Syntax Trees (ASTs), and Control Flow Graphs (CFGs). These tools struggle with patterns requiring deep understanding of developer intent, subjective assumptions, and complex contextual semantics.
  • Pure LLM Approaches: While Large Language Models (LLMs) excel at semantic reasoning, they suffer from hallucinations, high false-positive rates, and instability when analyzing long, complex contracts without strict code-level constraints.
• Gap: There is a lack of a unified framework that combines high-level semantic understanding with precise code-level verification to detect specific library misuse patterns.

2. Methodology: The LibScan Framework

LibScan is a hybrid detection framework that integrates LLM-based semantic reasoning with rule-based static analysis, enhanced by an iterative feedback mechanism.

A. Targeted Misuse Patterns

The system is designed to detect eight specific categories of library misuse, derived from empirical studies (Huang et al., 2024):

1. Invalid Wrapper Check in Library: Flawed logic in wrapper functions (e.g., missing return value checks).
2. Unhandled Exceptions in Library: Failure to handle exceptional responses from external contract calls.
3. Inappropriate Library Extension: Mixing multiple functionalities in a single function, increasing complexity and error risk.
4. Inappropriate Using For: Binding library functions to incompatible data types (e.g., using SafeMath for int256 instead of uint256).
5. Incomplete Function Replacement: Failing to replace all legacy unsafe calls with safer library versions.
6. Overestimated Library Capability: Assuming a library function does more than it actually does (e.g., checking contract existence without verifying deployment code).
7. Underestimated Library Capability: Redundantly implementing functions already optimized in the library.
8. Unnecessary Library Using: Including libraries that are unused or natively supported by newer compiler versions.

B. Core Components

1. LLM-Based Semantic Reasoning Module:

   • Prompt Engineering: Utilizes a PTS (Pre-generated, Then Selected) strategy inspired by Auto-CoT and Zero-shot-CoT. It forces the LLM to articulate its reasoning process ("Let's think step by step") before generating a final answer.
   • Iterative Feedback Loop: The system employs a Loop Feedback Iterative Optimization Algorithm. The LLM's initial output is fed back into the prompt as negative feedback or correction data. This process repeats (typically 3 iterations) to refine the detection, reduce hallucinations, and converge on the most accurate pattern.
   • Models Tested: GPT-4o, GPT-4 Turbo, DeepSeek-R1, and DeepSeek-V3.

2. Static Analysis Module:

   • BCSSM (Based on Code Similarity Static Matching): Uses TF-IDF vectors and cosine similarity to match input code against a database of known misuse code snippets. Effective for structural patterns (P4, P6–P8).
   • HCSA (Hybrid Context-Sensitive Static Analysis): Leverages Slither to generate ASTs and CFGs. It implements custom rules to analyze context, inheritance, and data dependencies, specifically targeting complex semantic patterns (P1–P3, P5).

3. Result Integration (Ensemble Learning):

   • The outputs from the LLM module and the Static Analysis module are combined using a Random Forest (RF) classifier.
   • The RF model treats the LLM prediction and Static Analysis prediction as categorical features. It aggregates votes from multiple decision trees to determine the final classification, effectively balancing the semantic strengths of the LLM with the deterministic precision of static analysis.

3. Key Contributions

• First Hybrid Tool: LibScan is the first tool to combine LLMs with static analysis specifically for detecting smart contract library misuse patterns.
• Pattern-Aware Knowledge Base: The authors constructed a structured knowledge base integrating descriptions of 8 misuse patterns with code-level scenarios, serving as a robust matching standard for the LLM.
• Iterative Self-Correction: Introduced a closed-loop feedback mechanism that significantly reduces LLM hallucinations and false positives by refining analysis across multiple rounds.
• Comprehensive Evaluation: Validated on a dataset of 662 real-world smart contracts, demonstrating superior performance over existing tools.

4. Experimental Results

The framework was evaluated on 662 real-world smart contracts using standard metrics (Accuracy, Precision, Recall, F1-Score).

• Overall Performance: LibScan achieved an overall detection accuracy of 85.15%.
• Comparison with Baselines:
  • LibScan: 85.15% Accuracy, 86.19% Precision.
  • Slither (Static Analysis only): 62.39% Accuracy.
  • GPTScan (LLM only): 68.91% Accuracy.
  • Improvement: LibScan outperforms existing tools by a margin of over 16 percentage points in accuracy.
• Ablation Studies:
  • Combining LLM and Static Analysis (All†) yielded significantly better results than using either method independently (LLM only: 73.56%; Static only: 70.66%).
  • The GPT-4 Turbo + HCSA combination was identified as the optimal baseline configuration.
• Iterative Optimization: The accuracy metrics improved with each iteration of the feedback loop, with the third iteration typically providing the best balance of performance and stability.

5. Significance and Impact

• Enhanced Security: By addressing the "library misuse" gap, LibScan helps prevent catastrophic financial losses caused by subtle logic errors that traditional tools miss.
• Methodological Advancement: The paper demonstrates that hybrid approaches (LLM + Static Analysis) are superior to single-modality solutions for complex security auditing tasks. It proves that LLMs can be made reliable for code analysis when constrained by iterative feedback and grounded in empirical data.
• Open Source: The authors have released the code and experimental data, fostering further research in smart contract security and automated auditing.

In summary, LibScan represents a significant step forward in smart contract security by bridging the gap between high-level semantic understanding and low-level code verification, specifically targeting the nuanced and dangerous problem of library misuse.