# SAILFISH: Vetting Smart Contract State-Inconsistency Bugs in Seconds

arXiv: https://arxiv.org/abs/2104.08638 · HTML: https://mlsanity.com/paper/2104.08638/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Apr 2021.

## Built on by (most cited first, 10 of 10)

- [GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis](https://mlsanity.com/paper/2308.03314/) (2023)
- [Blockchain Large Language Models](https://mlsanity.com/paper/2304.12749/) (2023)
- [Smart-LLaMA-DPO: Reinforced Large Language Model for Explainable Smart Contract Vulnerability Detection](https://mlsanity.com/paper/2506.18245/) (2025)
- [Detecting Buggy Contracts via Smart Testing](https://mlsanity.com/paper/2409.04597/) (2024)
- [Usenix'23 Extended Version: Smart Learning to Find Dumb Contracts](https://mlsanity.com/paper/2304.10726/) (2023)
- [Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization](https://mlsanity.com/paper/2603.26270/) (2026)
- [SEASONED: Semantic-Enhanced Self-Counterfactual Explainable Detection of Adversarial Exploiter Contracts](https://mlsanity.com/paper/2509.05681/) (2025)
- [Multi-Agent Collaborative Fuzzing with Continuous Reflection for Smart Contracts Vulnerability Detection](https://mlsanity.com/paper/2511.12164/) (2025)
- [AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling](https://mlsanity.com/paper/2606.05986/) (2026)
- [Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts](https://mlsanity.com/paper/2607.15673/) (2026)

## Abstract (arXiv)

This paper presents SAILFISH, a scalable system for automatically finding state-inconsistency bugs in smart contracts. To make the analysis tractable, we introduce a hybrid approach that includes (i) a light-weight exploration phase that dramatically reduces the number of instructions to analyze, and (ii) a precise refinement phase based on symbolic evaluation guided by our novel value-summary analysis, which generates extra constraints to over-approximate the side effects of whole-program execution, thereby ensuring the precision of the symbolic evaluation. We developed a prototype of SAILFISH and evaluated its ability to detect two state-inconsistency flaws, viz., reentrancy and transaction order dependence (TOD) in Ethereum smart contracts. Further, we present detection rules for other kinds of smart contract flaws that SAILFISH can be extended to detect. Our experiments demonstrate the efficiency of our hybrid approach as well as the benefit of the value summary analysis. In particular, we show that S SAILFISH outperforms five state-of-the-art smart contract analyzers (SECURITY, MYTHRIL, OYENTE, SEREUM and VANDAL ) in terms of performance, and precision. In total, SAILFISH discovered 47 previously unknown vulnerable smart contracts out of 89,853 smart contracts from ETHERSCAN .