# AI-Based Vulnerability Analysis of NFT Smart Contracts

arXiv: https://arxiv.org/abs/2504.16113 · HTML: https://mlsanity.com/paper/2504.16113/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 59 references that are in the map.
- First posted on arXiv 18 Apr 2025.

## Builds on (most cited first, 19 of 19)

- [Securify: Practical Security Analysis of Smart Contracts](https://mlsanity.com/paper/1806.01143/) (2018)
- [A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses](https://mlsanity.com/paper/1908.04507/) (2019)
- [How Effective are Smart Contract Analysis Tools? Evaluating Smart Contract Static Analysis Tools Using Bug Injection](https://mlsanity.com/paper/2005.11613/) (2020)
- [Unveiling Wash Trading in Popular NFT Markets](https://mlsanity.com/paper/2403.10361/) (2024)
- [StateGuard: Detecting State Derailment Defects in Decentralized Exchange Smart Contract](https://mlsanity.com/paper/2405.09181/) (2024)
- [SCALM: Detecting Bad Practices in Smart Contracts Through LLMs](https://mlsanity.com/paper/2502.04347/) (2025)
- [Security Analysis Methods on Ethereum Smart Contract Vulnerabilities: A Survey](https://mlsanity.com/paper/1908.08605/) (2019)
- [Improving Smart Contract Security with Contrastive Learning-based Vulnerability Detection](https://mlsanity.com/paper/2404.17839/) (2024)
- [DeFiTail: DeFi Protocol Inspection through Cross-Contract Execution Analysis](https://mlsanity.com/paper/2405.11035/) (2024)
- [Characterizing Erasable Accounts in Ethereum](https://mlsanity.com/paper/2009.00607/) (2020)
- [GasTrace: Detecting Sandwich Attack Malicious Accounts in Ethereum](https://mlsanity.com/paper/2405.19971/) (2024)
- [Smart Contracts in the Real World: A Statistical Exploration of External Data Dependencies](https://mlsanity.com/paper/2406.13253/) (2024)
- [Detecting Malicious Accounts in Web3 through Transaction Graph](https://mlsanity.com/paper/2410.20713/) (2024)
- [SoK: Security Analysis of Blockchain-based Cryptocurrency](https://mlsanity.com/paper/2503.22156/) (2025)
- [Enhancing Smart Contract Vulnerability Detection in DApps Leveraging Fine-Tuned LLM](https://mlsanity.com/paper/2504.05006/) (2025)
- [An Overview of AI and Blockchain Integration for Privacy-Preserving](https://mlsanity.com/paper/2305.03928/) (2023)
- [SCLA: Automated Smart Contract Summarization via LLMs and Control Flow Prompt](https://mlsanity.com/paper/2402.04863/) (2024)
- [Guardians of the Ledger: Protecting Decentralized Exchanges from State Derailment Defects](https://mlsanity.com/paper/2411.18935/) (2024)
- [Definition and Detection of Defects in NFT Smart Contracts](https://mlsanity.com/paper/2305.15829/) (2023)

## Built on by (most cited first, 1 of 1)

- [A Novel GPT-Based Framework for Anomaly Detection in System Logs](https://mlsanity.com/paper/2510.16044/) (2025)

## Abstract (arXiv)

With the rapid growth of the NFT market, the security of smart contracts has become crucial. However, existing AI-based detection models for NFT contract vulnerabilities remain limited due to their complexity, while traditional manual methods are time-consuming and costly. This study proposes an AI-driven approach to detect vulnerabilities in NFT smart contracts. We collected 16,527 public smart contract codes, classifying them into five vulnerability categories: Risky Mutable Proxy, ERC-721 Reentrancy, Unlimited Minting, Missing Requirements, and Public Burn. Python-processed data was structured into training/test sets. Using the CART algorithm with Gini coefficient evaluation, we built initial decision trees for feature extraction. A random forest model was implemented to improve robustness through random data/feature sampling and multitree integration. GridSearch hyperparameter tuning further optimized the model, with 3D visualizations demonstrating parameter impacts on vulnerability detection. Results show the random forest model excels in detecting all five vulnerabilities. For example, it identifies Risky Mutable Proxy by analyzing authorization mechanisms and state modifications, while ERC-721 Reentrancy detection relies on external call locations and lock mechanisms. The ensemble approach effectively reduces single-tree overfitting, with stable performance improvements after parameter tuning. This method provides an efficient technical solution for automated NFT contract detection and lays groundwork for scaling AI applications.