💻 computer science

PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement

This paper introduces PSR², a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning to significantly improve the detection of atomicity violations in smart contracts, achieving a 94.69% F1-score on complex ERC-721 scenarios while substantially reducing false positives compared to existing tools.

Original authors: Xiaoqi Li, Xin Wang, Wenkai Li, Zongwei Li

Published 2026-04-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Xiaoqi Li, Xin Wang, Wenkai Li, Zongwei Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the security chief of a high-stakes bank. Your job is to make sure that when a customer asks for a loan, the bank doesn't accidentally give them the money before checking their credit score, or worse, give them the money twice because the system got confused in the middle of the process.

In the world of blockchain and "Smart Contracts" (which are just automated bank rules written in code), this specific type of confusion is called an Atomicity Violation. It's when a multi-step process gets interrupted, leaving the system in a broken, unsafe state.

The paper you provided introduces PSR2, a new security tool designed to catch these mistakes better than any tool currently on the market. Here is how it works, explained through simple analogies.

The Problem: The "Blind" and the "Dumb"

Currently, security tools used to check these contracts fall into two bad categories:

The "Rule-Follower" (Like Slither): This tool is like a security guard who only looks at a checklist. If he sees a sign that says "Do not enter," he stops. But if the sign is hidden behind a curtain, or if the "Do not enter" sign is actually a joke, he misses it. He lacks context. He sees a dangerous pattern but doesn't understand why it's dangerous or if it can actually happen.
The "Pattern Matcher" (Like Semgrep): This tool is like a detective who only looks for specific fingerprints. If the criminal wears different gloves, the detective misses them. It looks at the local code (the syntax) but doesn't understand the journey the code takes. It might flag a harmless line of code as a crime just because it looks suspicious, leading to lots of false alarms.

The Result: Real hackers slip through the cracks, and security teams waste time chasing ghosts (false alarms).

The Solution: PSR2 (The "Super Detective")

The authors created PSR2, which acts like a brilliant detective team that combines two different ways of thinking to solve the case. They call this a "Phase-based Semantic Reasoning Framework."

Think of PSR2 as a three-step investigation process:

Step 1: The Map Maker (GSAM)

First, the tool builds a map of the code. Imagine the code is a giant maze.

This module (GSAM) looks at the maze and asks: "Is there a path where a thief could run in, steal the money, and run out before the alarm goes off?"
It finds all the suspicious routes where a "Read" (checking a balance), a "Call" (talking to another contract), and a "Write" (changing the balance) happen in a dangerous order.
Analogy: It's like a traffic cop identifying all the intersections where a car could run a red light.

Step 2: The Context Reader (SCAM)

Next, the tool reads the story behind the map.

This module (SCAM) looks at the specific details. It asks: "Okay, we found a suspicious path, but does the thief actually have the keys? Is the 'Read' actually checking the right account? Is the 'Call' actually talking to a real person or just a dummy?"
It extracts the "facts" of the situation.
Analogy: It's like a private investigator checking the driver's license. Just because a car could run a red light doesn't mean the driver will. Maybe the driver is a police officer on duty (benign update), not a criminal.

Step 3: The Judge (FDM)

Finally, the Fusion Decision Module acts as the judge. It takes the Map Maker's list of "possible crimes" and the Context Reader's list of "facts."

It cross-references them.
The Verdict: "We only have a crime if the path exists AND the facts prove the thief has the means and motive."
If the path exists but the facts say it's safe, the judge dismisses the case (no false alarm).
If the facts say it's dangerous but the path was missed by the map, the judge catches it (no missed crime).

Why is this a big deal?

The paper tested PSR2 on 1,600 different smart contracts (including complex ones like NFTs, which are digital collectibles).

Old Tools: In the complex NFT scenarios, the best existing tools only got about 52% of the answers right. They were either missing real bugs or crying wolf too often.
PSR2: The new tool got 94.7% of the answers right.

The Takeaway

PSR2 is like upgrading from a security guard with a clipboard to a team of detectives with a full case file. By combining structural path searching (looking at the map) with semantic reasoning (understanding the story), it stops the "blind spots" that let hackers steal money and the "noise" that wastes security teams' time.

It proves that to secure the future of decentralized finance, we need tools that don't just look at what the code says, but understand what the code is actually doing.

1. Problem Statement

The paper addresses the critical security challenge of atomicity violations in smart contracts, particularly within complex decentralized applications like Oracles and NFTs (ERC-721). These violations occur when a contract's state is updated inconsistently due to external calls interrupting a read-write sequence (e.g., the "Check-Effects-Interactions" pattern is violated).

Existing static analysis tools face two primary limitations:

Contextual Blindness (C1): Tools relying on rigid rule sets (e.g., Slither) lack deep semantic awareness. They cannot distinguish between benign state updates and malicious exploitations, leading to high False Positive (FP) rates.
Topological Insensitivity (C2): Pattern-matching engines (e.g., Semgrep) focus on local syntax but fail to verify if a hazardous pattern is actually reachable via a valid control flow path. This leads to high False Negative (FN) rates, especially in complex scenarios involving implicit callbacks (e.g., onERC721Received).

2. Methodology: The PSR2 Framework

PSR2 is a collaborative static analysis framework designed to harmonize structural path searching with deterministic semantic reasoning. It operates in three distinct stages:

A. Semantic Context Analysis Module (SCAM)

Function: Parses the smart contract source code into an Abstract Syntax Tree (AST) to extract deterministic semantic facts.
Output: A semantic repository $\mathcal{F}$ $F$ containing:
- Function/State Profiling: Formal descriptors for functions and state variables, categorizing their logical roles (e.g., price, update) and access patterns (read/write).
- Interaction Dependency Extraction: Analyzes external call sites to generate dependency tuples ( $T_e$ ). Crucially, it constructs a dependency set ( $D$ ) identifying which state variables dictate the parameters or conditions of an external call.

B. Graph Structure Analysis Module (GSAM)

Function: Transforms the Control Flow Graph (CFG) into a simplified, labeled graph to verify path reachability and operation sequencing.
Mechanism: It filters out irrelevant logic and maps nodes to critical atomicity operations (SLOAD, SSTORE, CALL, CHECK).
Pattern Verification: It searches for "Dependent State Paths" containing the specific sequence: Read ($SLOAD $)$ \rightarrow$ Call ($CALL $)$ \rightarrow$ Write ($SSTORE$).
Output: A set of structurally suspicious paths ( $P_{suspicious}$ ) where an external call interrupts a read-write sequence on a critical variable.

C. Fusion Decision Module (FDM)

Function: Acts as the logical gatekeeper, performing formal cross-validation between the structural alerts from GSAM and the semantic facts from SCAM.
Decision Logic: A vulnerability is confirmed only if:
1. Structural Reachability: A hazardous path exists (from GSAM).
2. Semantic Dependency: The state variable involved in the path is actually dependent on the external call target (from SCAM).
3. Target Type: The call target is not a fixed address (indicating potential user-controlled input).
Outcome: This fusion prunes structurally valid but semantically infeasible paths, significantly reducing false positives while capturing implicit vulnerabilities.

3. Key Contributions

PSR2 Framework: A novel architecture that integrates path-sensitive graph analysis with context-aware semantic extraction, effectively resolving the precision-recall trade-off inherent in traditional tools.
Unified Atomicity Inconsistency Model: The authors define a consistent logic primitive that abstracts diverse vulnerabilities (Reentrancy, Unchecked External Calls) into a single structural violation sequence: $\langle SLOAD(s), CALL(t), SSTORE(s) \rangle$ .
Fusion Decision Module (FDM): A mechanism that aligns structural paths with semantic data flows, enabling interpretable and accurate detection of "structurally hidden" vulnerabilities (e.g., in ERC-721 callbacks).

4. Experimental Results

The framework was evaluated on a dataset of 1,600 smart contract samples across three benchmarks: Smartbugs-Reentrancy, ERC-721 Reentrancy, and Smartbugs-Unchecked External Call. It was compared against Slither and Semgrep.

Overall Performance: PSR2 achieved an F1-score of 94.69% in complex ERC-721 scenarios, significantly outperforming Semgrep (51.86%) and Slither (23.68%).
Precision & Recall:
- ERC-721: PSR2 achieved 94.94% Precision and 89.91% Recall.
- Unchecked Calls: PSR2 maintained 98.04% Recall, whereas Semgrep dropped to 9.65%.
Ablation Study:
- Using only the Graph module ( $PSR2_{GSAM}$ ) resulted in an 11.27% False Positive Rate (FPR).
- Using only the Semantic module ( $PSR2_{SCAM}$ ) resulted in an 88.81% FPR (over-reporting).
- The Full Fusion approach reduced the FPR to 6.40% while increasing Recall to 92.35%, proving the necessity of combining both modules.

5. Significance and Impact

Solving the "Implicit Callback" Problem: PSR2 successfully detects vulnerabilities in ERC-721 contracts where risks are embedded in global execution topology rather than local syntax, a known weakness of current tools.
Generalizability: By abstracting bugs into a unified "Atomic Inconsistency" primitive, the framework is robust against diverse and non-standard implementation styles, unlike rigid rule-based systems.
Future Security: The work establishes a scalable foundation for securing evolving DeFi protocols against sophisticated cross-contract exploits, moving beyond manual rule-writing toward automated, semantic reasoning.

In conclusion, PSR2 represents a significant advancement in smart contract security by bridging the gap between structural control flow analysis and deep semantic understanding, offering a highly accurate solution for detecting atomicity violations.