# Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization

arXiv: https://arxiv.org/abs/2603.26270 · HTML: https://mlsanity.com/paper/2603.26270/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 35 of its 63 references that are in the map.
- First posted on arXiv 27 Mar 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 30 of 35)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Large Language Models are Zero-Shot Reasoners](https://mlsanity.com/paper/2205.11916/) (2022)
- [SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering](https://mlsanity.com/paper/2405.15793/) (2024)
- [From Local to Global: A Graph RAG Approach to Query-Focused Summarization](https://mlsanity.com/paper/2404.16130/) (2024)
- [M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings Through Self-Knowledge Distillation](https://mlsanity.com/paper/2402.03216/) (2024)
- [RepoCoder: Repository-Level Code Completion Through Iterative Retrieval and Generation](https://mlsanity.com/paper/2303.12570/) (2023)
- [Fuzz4All: Universal Fuzzing with Large Language Models](https://mlsanity.com/paper/2308.04748/) (2023)
- [Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG](https://mlsanity.com/paper/2406.11147/) (2024)
- [GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis](https://mlsanity.com/paper/2308.03314/) (2023)
- [Repoformer: Selective Retrieval for Repository-Level Code Completion](https://mlsanity.com/paper/2403.10059/) (2024)
- [Combining Fine-Tuning and LLM-based Agents for Intuitive Smart Contract Auditing with Justifications](https://mlsanity.com/paper/2403.16073/) (2024)
- [PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation](https://mlsanity.com/paper/2405.02580/) (2024)
- [SoK: Decentralized Finance (DeFi) Attacks](https://mlsanity.com/paper/2208.13035/) (2022)
- [sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts](https://mlsanity.com/paper/2004.08563/) (2020)
- [Give LLMs a Security Course: Securing Retrieval-Augmented Code Generation via Knowledge Injection](https://mlsanity.com/paper/2504.16429/) (2025)
- [ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space](https://mlsanity.com/paper/2506.10323/) (2025)
- [SAILFISH: Vetting Smart Contract State-Inconsistency Bugs in Seconds](https://mlsanity.com/paper/2104.08638/) (2021)
- [AuditGPT: Auditing Smart Contracts with ChatGPT](https://mlsanity.com/paper/2404.04306/) (2024)
- [AI Agent Smart Contract Exploit Generation](https://mlsanity.com/paper/2507.05558/) (2025)
- [EVMbench: Evaluating AI Agents on Smart Contract Security](https://mlsanity.com/paper/2603.04915/) (2026)
- [SmartInv: Multimodal Learning for Smart Contract Invariant Inference](https://mlsanity.com/paper/2411.09217/) (2024)
- [Good News for Script Kiddies? Evaluating Large Language Models for Automated Exploit Generation](https://mlsanity.com/paper/2505.01065/) (2025)
- [Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We?](https://mlsanity.com/paper/2404.18186/) (2024)
- [A Systematic Study on Generating Web Vulnerability Proof-of-Concepts Using Large Language Models](https://mlsanity.com/paper/2510.10148/) (2025)
- [SmartPoC: Generating Executable and Validated PoCs for Smart Contract Bug Reports](https://mlsanity.com/paper/2511.12993/) (2025)
- [ItyFuzz: Snapshot-Based Fuzzer for Smart Contract](https://mlsanity.com/paper/2306.17135/) (2023)
- [Prompt to Pwn: Automated Exploit Generation for Smart Contracts](https://mlsanity.com/paper/2508.01371/) (2025)
- [Smart Contract Fuzzing Towards Profitable Vulnerabilities](https://mlsanity.com/paper/2501.08834/) (2025)
- [Directed Greybox Fuzzing via Large Language Model](https://mlsanity.com/paper/2505.03425/) (2025)

## Built on by (most cited first, 1 of 1)

- [DeXposure-Claw: An Agentic System for DeFi Risk Supervision](https://mlsanity.com/paper/2606.19501/) (2026)

## Abstract (arXiv)

Smart contracts govern billions of dollars in decentralized finance (DeFi), yet automated vulnerability detection remains challenging because many vulnerabilities are tightly coupled with project-specific business logic. We observe that recurring vulnerabilities across diverse DeFi business models often share the same underlying economic mechanisms, which we term DeFi semantics, and that capturing these shared abstractions can enable more systematic auditing. Building on this insight, we propose Knowdit, a knowledge-driven, agentic workflow for smart contract vulnerability detection. Knowdit first constructs an auditing knowledge graph from historical human audit reports, linking fine-grained DeFi semantics with recurring vulnerability patterns. Given a new project, a multi-agent pipeline leverages this knowledge through an iterative loop of specification generation, Proof-of-Concept (PoC) synthesis, PoC execution, and finding reflection, driven by a shared repository index. We evaluate Knowdit on 11 recent Code4rena projects with 84 ground-truth vulnerabilities. Knowdit detects all 21 high-severity and 90% of medium-severity vulnerabilities without false positives, fully covering eight projects, significantly outperforming all baselines. Applied to seven real-world projects, Knowdit further discovers 9 high- and 36 medium-severity previously unknown vulnerabilities, securing millions in liquidity and proving its outstanding performance.