# Automated Vulnerability Injection in Smart Contracts Using Large Language Models

arXiv: https://arxiv.org/abs/2609.02624 · HTML: https://mlsanity.com/paper/2609.02624/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 27 references that are in the map.
- First posted on arXiv 2 Sep 2026.

## Builds on (most cited first, 12 of 12)

- [A Prompt Pattern Catalog to Enhance Prompt Engineering with ChatGPT](https://mlsanity.com/paper/2302.11382/) (2023)
- [GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis](https://mlsanity.com/paper/2308.03314/) (2023)
- [LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights](https://mlsanity.com/paper/2502.07049/) (2025)
- [Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts](https://mlsanity.com/paper/1910.10601/) (2019)
- [Mutation-Guided LLM-based Test Generation at Meta](https://mlsanity.com/paper/2501.12862/) (2025)
- [How Effective are Smart Contract Analysis Tools? Evaluating Smart Contract Static Analysis Tools Using Bug Injection](https://mlsanity.com/paper/2005.11613/) (2020)
- [SmartBugs 2.0: An Execution Framework for Weakness Detection in Ethereum Smart Contracts](https://mlsanity.com/paper/2306.05057/) (2023)
- [FORGE: An LLM-driven Framework for Large-Scale Smart Contract Vulnerability Dataset Construction](https://mlsanity.com/paper/2506.18795/) (2025)
- [OpenSCV: An Open Hierarchical Taxonomy for Smart Contract Vulnerabilities](https://mlsanity.com/paper/2303.14523/) (2023)
- [Consolidation of Ground Truth Sets for Weakness Detection in Smart Contracts](https://mlsanity.com/paper/2304.11624/) (2023)
- [Automated Vulnerability Injection in Solidity Smart Contracts: A Mutation-Based Approach for Benchmark Development](https://mlsanity.com/paper/2504.15948/) (2025)
- [Analyzing the Impact of Elusive Faults on Blockchain Reliability](https://mlsanity.com/paper/2304.05520/) (2023)

## Abstract (arXiv)

Assessing vulnerability detection tools for smart contracts requires datasets with known ground truth, yet such datasets are scarce and difficult to build by hand. We propose an approach that uses Large Language Models (LLMs) to automatically inject vulnerabilities into Solidity smart contracts, and demonstrate it in a case study targeting 49 vulnerability types from OpenSCV. Injected contracts are validated through a multi-step pipeline checking compilation, execution, business logic, and the presence of the intended vulnerability. Applied to real-world contracts from SmartBugs, LLMs generate nearly 1,000 candidate variants; after deduplication and validation, 32 confirmed vulnerable contracts spanning 25 vulnerability types survive (a 16.58% survival rate). Surviving contracts concentrate in structurally simpler targets and vulnerability types with localized syntactic patterns. We report practical challenges including LLMs' non-determinism and the difficulty of preserving contract semantics. We then use the validated contracts to assess three static analyzers, revealing complementary and incomplete coverage profiles. Results show that LLM-based vulnerability injection is feasible, while exposing key limitations in scalability and diversity.