{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T16:06:10Z","timestamp":1784217970209,"version":"3.55.0"},"reference-count":46,"publisher":"Association for Computing Machinery (ACM)","issue":"8","funder":[{"name":"National Key Research and Development Program of China","award":["Grant No. 2023YFB2703704"],"award-info":[{"award-number":["Grant No. 2023YFB2703704"]}]},{"name":"Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing","award":["Grant No. GJJ-25-002"],"award-info":[{"award-number":["Grant No. GJJ-25-002"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["Grant Nos. 62372149, U23A20303, and 62372173"],"award-info":[{"award-number":["Grant Nos. 62372149, U23A20303, and 62372173"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2026,8,31]]},"abstract":"<jats:p>\n                    Large Language Models (LLMs) have demonstrated significant potential in smart contract auditing. However, they are still susceptible to hallucinations and limited context-aware reasoning. In this article, we propose SmartAuditFlow, a dynamic Plan-Execute framework that customizes audit strategies based on the unique characteristics of each smart contract. Unlike static, rule-based workflows, our approach iteratively generates and refines audit plans in response to intermediate outputs and newly detected vulnerabilities. To improve reliability, the framework incorporates structured reasoning, prompt optimization, and external tools such as static analyzers and Retrieval-Augmented Generation (RAG). This multi-layered design reduces false positives and enhances the accuracy of vulnerability detection. Experimental results show that SmartAuditFlow achieves 100% accuracy on common vulnerability benchmarks and successfully identifies 13 additional CVEs missed by existing methods. These findings underscore the framework\u2019s adaptability, precision, and practical utility as a robust solution for automated smart contract security auditing. The source code is available at:\n                    <jats:ext-link xmlns:xlink=\"http:\/\/www.w3.org\/1999\/xlink\" ext-link-type=\"uri\" xlink:href=\"https:\/\/github.com\/JimmyLin-afk\/SmartAuditFlow\">https:\/\/github.com\/JimmyLin-afk\/SmartAuditFlow<\/jats:ext-link>\n                    .\n                  <\/jats:p>","DOI":"10.1145\/3785364","type":"journal-article","created":{"date-parts":[[2025,12,17]],"date-time":"2025-12-17T15:56:57Z","timestamp":1765987017000},"page":"1-43","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["SmartAuditFlow: A Dynamic Plan-Execute Framework for Advanced Smart Contract Security Analysis"],"prefix":"10.1145","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-3539-8659","authenticated-orcid":false,"given":"Zhiyuan","family":"Wei","sequence":"first","affiliation":[{"name":"Beijing Institute of Technology, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1979-6622","authenticated-orcid":false,"given":"Jing","family":"Sun","sequence":"additional","affiliation":[{"name":"University of Auckland\u2014City Campus, Auckland, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7164-0580","authenticated-orcid":false,"given":"Zhe","family":"Hou","sequence":"additional","affiliation":[{"name":"Griffith University, Brisbane, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6313-4407","authenticated-orcid":false,"given":"Zijian","family":"Zhang","sequence":"additional","affiliation":[{"name":"Beijing Institute of Technology, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-0067-3101","authenticated-orcid":false,"given":"Zixiao","family":"Zhao","sequence":"additional","affiliation":[{"name":"University of Auckland\u2014City Campus, Auckland, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8196-5274","authenticated-orcid":false,"given":"Chunmiao","family":"Li","sequence":"additional","affiliation":[{"name":"Beijing Academy of Blockchain and Edge Computing, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-7463-9922","authenticated-orcid":false,"given":"Mingchao","family":"Wan","sequence":"additional","affiliation":[{"name":"Beijing Academy of Blockchain and Edge Computing, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-9708-0220","authenticated-orcid":false,"given":"Jin","family":"Dong","sequence":"additional","affiliation":[{"name":"Beijing Academy of Blockchain and Edge Computing, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,16]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548683"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1186\/s13054-023-04393-x"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/3442188.3445922"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i16.29720"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3623302"},{"key":"e_1_3_2_7_2","unstructured":"Chong Chen Jianzhong Su Jiachi Chen Yanlin Wang Tingting Bi Jianxing Yu Yanli Wang Xingwei Lin Ting Chen and Zibin Zheng. 2023. When ChatGPT meets smart contract vulnerability detection: How far are we? arXiv:2309.05520. Retrieved from https:\/\/arxiv.org\/abs\/2309.05520"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607242"},{"key":"e_1_3_2_9_2","unstructured":"Jiale Cheng Xiao Liu Kehan Zheng Pei Ke Hongning Wang Yuxiao Dong Jie Tang and Minlie Huang. 2023. Black-box prompt optimization: Aligning large language models without model training. arXiv:2311.04155. Retrieved from https:\/\/arxiv.org\/abs\/2311.04155"},{"key":"e_1_3_2_10_2","unstructured":"Isaac David Liyi Zhou Kaihua Qin Dawn Song Lorenzo Cavallaro and Arthur Gervais. 2023. Do you still need a manual smart contract audit? arXiv:2306.12338. Retrieved from https:\/\/doi.org\/10.48550\/arXiv.2306.12338"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380364"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.eacl-demo.16"},{"key":"e_1_3_2_13_2","unstructured":"Jinlan Fu See-Kiong Ng Zhengbao Jiang and Pengfei Liu. 2023. GPTScore: Evaluate as you desire. arXiv:2302.04166. Retrieved from https:\/\/arxiv.org\/abs\/2302.04166"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3706598.3713218"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597206"},{"key":"e_1_3_2_16_2","first-page":"22895","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Kambhampati Subbarao","year":"2024","unstructured":"Subbarao Kambhampati, Karthik Valmeekam, Lin Guan, Mudit Verma, Kaya Stechly, Siddhant Bhambri, Lucas Saldyt, and Anil Murthy. 2024. Position: LLMs can\u2019t plan, but can help planning in LLM-Modulo frameworks. In Proceedings of the International Conference on Machine Learning. PMLR, 22895\u201322907."},{"key":"e_1_3_2_17_2","unstructured":"Avishree Khare Saikat Dutta Ziyang Li Alaia Solko-Breslin Rajeev Alur and Mayur Naik. 2023. Understanding the effectiveness of large language models in detecting security vulnerabilities. arXiv:2311.16169. Retrieved from https:\/\/arxiv.org\/abs\/2311.16169"},{"key":"e_1_3_2_18_2","first-page":"9459","article-title":"Retrieval-augmented generation for knowledge-intensive NLP tasks","volume":"33","author":"Lewis Patrick","year":"2020","unstructured":"Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K\u00fcttler, Mike Lewis, Wen-tau Yih, Tim Rockt\u00e4schel, Sebastian Riedel, et al. 2020. Retrieval-augmented generation for knowledge-intensive NLP tasks. In Proceedings of the Advances in Neural Information Processing Systems, Vol. 33, 9459\u20139474.","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2264"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623612"},{"key":"e_1_3_2_21_2","unstructured":"Ziyang Li Saikat Dutta and Mayur Naik. 2024. LLM-assisted static analysis for detecting security vulnerabilities. arXiv:2405.17238. Retrieved from https:\/\/arxiv.org\/abs\/2405.17238"},{"key":"e_1_3_2_22_2","first-page":"3585","volume-title":"Proceedings of the 33rd USENIX Security Symposium (USENIX Security \u201924)","author":"Liu Han","year":"2024","unstructured":"Han Liu, Daoyuan Wu, Yuqiang Sun, Haijun Wang, Kaixuan Li, Yang Liu, and Yixiang Chen. 2024. Using my functions should follow my checks: Understanding and detecting insecure OpenZeppelin code in smart contracts. In Proceedings of the 33rd USENIX Security Symposium (USENIX Security \u201924). USENIX Association, 3585\u20133601."},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0943"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.5555\/3698900.3698946"},{"key":"e_1_3_2_25_2","doi-asserted-by":"crossref","unstructured":"Yang Liu Dan Iter Yichong Xu Shuohang Wang Ruochen Xu and Chenguang Zhu. 2023. G-eval: NLG evaluation using GPT-4 with better human alignment. arXiv:2303.16634. Retrieved from https:\/\/arxiv.org\/abs\/2303.16634","DOI":"10.18653\/v1\/2023.emnlp-main.153"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241357"},{"key":"e_1_3_2_27_2","unstructured":"Wei Ma Daoyuan Wu Yuqiang Sun Tianwen Wang Shangqing Liu Jian Zhang Yue Xue and Yang Liu. 2024. Combining fine-tuning and LLM-based agents for intuitive smart contract auditing with justifications. arXiv:2403.16073. Retrieved from https:\/\/arxiv.org\/abs\/2403.16073"},{"key":"e_1_3_2_28_2","unstructured":"Iman Mirzadeh Keivan Alizadeh Hooman Shahrokhi Oncel Tuzel Samy Bengio and Mehrdad Farajtabar. 2024. GSM-symbolic: Understanding the limitations of mathematical reasoning in large language models. arXiv:2410.05229. Retrieved from https:\/\/arxiv.org\/abs\/2410.05229"},{"key":"e_1_3_2_29_2","doi-asserted-by":"crossref","unstructured":"Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence embeddings using Siamese BERT-networks. arXiv:1908.10084. Retrieved from https:\/\/arxiv.org\/abs\/1908.10084","DOI":"10.18653\/v1\/D19-1410"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-021-27374-6"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639117"},{"key":"e_1_3_2_32_2","unstructured":"Yuqiang Sun Daoyuan Wu Yue Xue Han Liu Wei Ma Lyuye Zhang Yang Liu and Yingjiu Li. 2024. LLM4Vuln: A unified evaluation framework for decoupling and enhancing LLMs\u2019 vulnerability reasoning. arXiv:2401.16185. Retrieved from https:\/\/arxiv.org\/abs\/2401.16185"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3464421"},{"key":"e_1_3_2_34_2","article-title":"Attention is all you need","volume":"30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Proceedings of the Advances in Neural Information Processing Systems, Vol. 30.","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-024-40231-1"},{"key":"e_1_3_2_36_2","unstructured":"Xuezhi Wang and Denny Zhou. 2024. Chain-of-thought reasoning without prompting. arXiv:2402.10200. Retrieved from https:\/\/arxiv.org\/abs\/2402.10200"},{"key":"e_1_3_2_37_2","unstructured":"Jason Wei Nguyen Karina Hyung Won Chung Yunxin Joy Jiao Spencer Papay Amelia Glaese John Schulman and William Fedus. 2024. Measuring short-form factuality in large language models. arXiv:2411.04368. Retrieved from https:\/\/arxiv.org\/abs\/2411.04368"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3695864"},{"key":"e_1_3_2_39_2","unstructured":"Yixuan Weng Minjun Zhu Fei Xia Bin Li Shizhu He Shengping Liu Bin Sun Kang Liu and Jun Zhao. 2022. Large language models are better reasoners with self-verification. arXiv:2212.09561. Retrieved from https:\/\/arxiv.org\/abs\/2212.09561"},{"key":"e_1_3_2_40_2","unstructured":"Shihao Xia Shuai Shao Mengting He Tingting Yu Linhai Song and Yiying Zhang. 2024. AuditGPT: Auditing smart contracts with ChatGPT. arXiv:2404.04306. Retrieved from https:\/\/arxiv.org\/abs\/2404.04306"},{"key":"e_1_3_2_41_2","article-title":"Tree of Thoughts: Deliberate problem solving with large language models","volume":"36","author":"Yao Shunyu","year":"2024","unstructured":"Shunyu Yao, Dian Yu, Jeffrey Zhao, Izhak Shafran, Thomas L. Griffiths, Yuan Cao, and Karthik Narasimhan. 2024. Tree of Thoughts: Deliberate problem solving with large language models. In Proceedings of the Advances in Neural Information Processing Systems, Vol. 36.","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3470333"},{"key":"e_1_3_2_43_2","unstructured":"Jiayi Zhang Jinyu Xiang Zhaoyang Yu Fengwei Teng Xionghui Chen Jiaqi Chen Mingchen Zhuge Xin Cheng Sirui Hong and Jinlin Wang et al. 2024. AFlow: Automating agentic workflow generation. arXiv:2410.10762. Retrieved from https:\/\/arxiv.org\/abs\/2410.10762"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00061"},{"key":"e_1_3_2_45_2","unstructured":"Tianyang Zhong Zhengliang Liu Yi Pan Yutong Zhang Zeyu Zhang Yifan Zhou Shizhe Liang Zihao Wu Yanjun Lyu Peng Shu et al. 2024. Evaluation of openAI o1: Opportunities and challenges of AGI. arXiv:2409.18486. Retrieved from https:\/\/arxiv.org\/abs\/2409.18486"},{"key":"e_1_3_2_46_2","unstructured":"Yongchao Zhou Andrei Ioan Muresanu Ziwen Han Keiran Paster Silviu Pitis Harris Chan and Jimmy Ba. 2022. Large language models are human-level prompt engineers. arXiv:2211.01910. Retrieved from https:\/\/arxiv.org\/abs\/2211.01910"},{"key":"e_1_3_2_47_2","first-page":"62743","volume-title":"Proceedings of the 41st International Conference on Machine Learning","author":"Zhuge Mingchen","year":"2024","unstructured":"Mingchen Zhuge, Wenyi Wang, Louis Kirsch, Francesco Faccio, Dmitrii Khizbullin, and J\u00fcrgen Schmidhuber 2024. GPTSwarm: Language agents as optimizable graphs. In Proceedings of the 41st International Conference on Machine Learning, 62743\u201362767."}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3785364","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T15:35:03Z","timestamp":1784216103000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3785364"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,16]]},"references-count":46,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2026,8,31]]}},"alternative-id":["10.1145\/3785364"],"URL":"https:\/\/doi.org\/10.1145\/3785364","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,16]]},"assertion":[{"value":"2025-05-24","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-11","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-07-16","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}