Evidence-Grounded Logic Vulnerability Detection for Smart Contracts via Runtime Context Reasoning

Abstract

Smart contracts are foundational to DeFi, yet detecting business-logic vulnerabilities, i.e., execution is syntactically correct but violates a contract’s intended behavior, remains difficult. Most recent LLM-based approaches still follow a largely static, source-code–centric auditing paradigm. In practice, however, smart contracts are inherently stateful: many logic flaws emerge only under specific contract states and across particular state transitions. As a result, code-only auditing can produce false positives and miss true vulnerabilities. To address this gap, we present RcAudit, a system for detecting smart-contract logic vulnerabilities via runtime-context–enhanced LLM reasoning. RcAudit constructs a Contract Logic Knowledge Base that captures contract behavior from multiple perspectives to support LLM analysis. It then applies a state- and intent-aware fuzzing strategy to generate logic-critical runtime contexts, and performs LLM reasoning over selected contexts that exhibit potential intent–behavior inconsistencies to pinpoint vulnerabilities. We evaluate RcAudit on three real-world datasets. RcAudit identifies 74 of 132 known logic vulnerabilities with high precision (96.9%), achieving 117.6% higher detection than the strongest baseline. Importantly, RcAudit further uncovers 22 zero-day vulnerabilities in real-world projects.