Work

Do Automated Fixes Truly Mitigate Smart Contract Exploits?

Year: 2025

Type: article

Abstract: Automated Program Repair (APR) for smart contract security promises to automatically mitigate smart contract vulnerabilities responsible for billions in financial losses. However, the true effectiveness of this research in addressing smart contract exploits remains uncharted territory. This paper bridges this critical gap by introducing a novel and systematic experimental framework for evaluating exploit mitigation of program repair tools for smart contracts.We qualitatively and quantitatively analyze 20 state-of-the-art APR tools using a dataset of 143 vulnerable smart contracts, for which we manually craft 91 executable exploits. We are the very first to define and measure the essential “exploit mitigation rate”, giving researchers and practitioners a real sense of effectiveness of cutting edge techniques. Our findings reveal substantial disparities in the state of the art, with an exploit mitigation rate ranging from a low of 29% to a high of 74%. Our study identifies systemic limitations, such as inconsistent functionality preservation, that must be addressed in future research on program repair for smart contracts.

Source: IEEE Transactions on Software Engineering

DOI: 10.1109/tse.2025.3618123

Authors: Sofia Bobadilla, Monica Jin, Martin Monperrus

Institution: KTH Royal Institute of Technology

Language: English

Topic: Software Testing and Debugging Techniques

Subfield: Software

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $2,645

Funders: Stiftelsen för Strategisk Forskning, Knut och Alice Wallenbergs Stiftelse, Stiftelsen för Strategisk Forskning