Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization¶

🕒 Published (v1): 2026-03-27 10:38 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Knowdit is a knowledge-driven, multi-agent framework for smart contract vulnerability detection that first builds an auditing knowledge graph from historical human audit reports, then uses it to drive an iterative loop of specification generation, harness synthesis, fuzz execution, and finding reflection. On 12 Code4rena projects it detects all 14 high-severity and 77% of medium-severity vulnerabilities with only 2 false positives, significantly outperforming all baselines.

Problem¶

Automated smart contract auditing fails because vulnerabilities are tightly coupled with project-specific DeFi business logic, making it impossible to define generic oracles. Existing tools lack high-level abstractions that capture the shared economic mechanisms—termed DeFi semantics—underlying diverse protocols; this causes high false-negative rates. Additionally, current methods rely on fixed templates or manual effort to inject auditing knowledge, preventing scalable adoption.

Method¶

Knowdit operates in two phases:

Phase 1 — Knowledge Graph Construction. An LLM-based multi-stage pipeline processes 270 historical human audit reports and their source code to populate a bipartite auditing knowledge graph \(G\). The DeFi Space encodes business types, Solidity projects, and fine-grained DeFi semantics (e.g., proportional-share token accounting); the Vulnerability Space encodes vulnerability patterns, auditing findings, and attack types. Edges capture historical project–finding traceability and causal may introduce links between DeFi semantics and vulnerability patterns. Semantics are extracted, deduplicated, and merged via chain-of-thought prompting with in-context examples; novel semantics become new graph nodes while overlapping ones are synthesized into merged nodes.

Phase 2 — Agentic Auditing. Given a new Solidity project, a Knowledge Mapper identifies its business types, retrieves associated DeFi semantics and vulnerability patterns from \(G\), and produces semantic–vulnerability pairs. Each pair is processed by a sequential four-agent loop sharing a Working Memory: 1. Specification Generator — produces an auditing specification for the semantic/vulnerability pair. 2. Harness Synthesizer — generates a concrete fuzz harness targeting the specification. 3. Fuzz Executor — runs the harness against the target contract. 4. Finding Reflector — interprets execution results; on failure, writes reflective feedback to Working Memory to guide harness/specification regeneration.

Confirmed vulnerabilities are reported and ingested back into \(G\), enabling continuous knowledge accumulation.

Key Contributions¶

Novel knowledge-driven agentic workflow (Knowdit) that couples a DeFi-semantics knowledge graph with an iterative harness-synthesis-and-fuzzing loop.
Auditing knowledge graph built from 270 historical projects, comprising 475 DeFi semantics across 13 business-type categories, 579 vulnerability patterns, and 2,096 semantic–vulnerability links.
Empirical evidence that knowledge-graph coverage (88% of ground-truth vulnerabilities) far exceeds the best baseline (45%), quantifying the contribution of structured auditing knowledge.
Real-world validation: 12 high-severity and 10 medium-severity previously unknown vulnerabilities confirmed and fixed by developers.

Results¶

Code4rena benchmark (12 projects, 100 contracts, 75 high/medium vulnerabilities):
100% recall on 14 high-severity vulnerabilities; 77% recall on 61 medium-severity vulnerabilities.
Only 2 false positives.
Significantly outperforms all baselines on both precision and recall.
Knowledge graph ablation: knowledge graph achieves 88% vulnerability coverage vs. 45% for the best baseline; ablation without the graph shows clear drops in both coverage and precision.
Real-world deployment (6 projects): discovers 12 high + 10 medium previously unknown vulnerabilities, all confirmed and patched by developers, including severe liquidity-draining issues with concrete proofs of exploitation.
Cost: higher token usage than baselines but substantially cheaper than manual auditing.

Limitations¶

Higher LLM token cost than tool baselines, though justified by detection of critical vulnerabilities.
Knowledge graph quality depends on the historical audit reports used for construction; rare or novel DeFi business types with no historical coverage may receive poor semantic mappings.
The paper text is truncated; further stated limitations in the evaluation section are not visible in the provided excerpt.
Business types and attack types are predefined from prior work, which may not cover emerging DeFi categories.

Relevance to Harnesses / Meta-Harnesses¶

Harness synthesis is a first-class component of Knowdit's agentic loop: rather than hand-writing fuzz harnesses, an LLM agent synthesizes them on-demand conditioned on a retrieved auditing specification and reflects on execution failures to iteratively repair them—a direct instantiation of the meta-harness concept applied to smart contract security. The system also demonstrates how a knowledge-graph-backed meta-harness can encode corpus-derived auditing heuristics and propagate them to new targets, complementing the broader line of work on harness generation from specifications. The Working Memory mechanism, shared across all four agents and used to accumulate reflective feedback across iterations, is a practical realization of persistent state in a multi-agent meta-harness architecture. For researchers tracking harness-generation harnesses, Knowdit offers a concrete domain instantiation with quantified ablation results isolating the contribution of structured prior knowledge.