Smart contracts are programs on a blockchain that automatically execute the terms of a transaction. They can be compared to a vending machine: payment is made, the goods are dispensed. Such contracts are used for cryptocurrency payments, online lending and the exchange of digital assets, and they often hold large sums.
The main weakness of smart contracts is that once launched, their code cannot be changed. A single programmer error becomes a permanent loophole for attackers, and stolen funds are rarely recovered.
Automated vulnerability detection tools exist, but they have limitations. Many assess only the contract as a whole, leaving the developer to find the problem area manually. Most issue brief warnings without explaining what makes the code dangerous and how to fix it. In addition, there was no large dataset with error annotations at the level of individual functions - the building blocks that programmers write and check.
A group led by Professor Le-Minh Nguyen and doctoral student Ngoc-Minh Nguyen of the Japan Advanced Institute of Science and Technology (JAIST) has developed a unified system for detecting and explaining vulnerabilities. The work was published in the journal ACM Transactions on Software Engineering and Methodology on September 15, 2026.
The system consists of three parts. First, the researchers created a tool that automatically introduces realistic errors into real contracts. The result was an open dataset of 4,208 contracts and more than 118,000 functions, covering eight types of vulnerabilities.
They then developed a graph neural network called HCA-SGNN. It represents a contract as a network of connected code elements and analyzes each function separately while taking into account how functions interact with each other. This is important for attacks such as reentrancy, which use several functions at once. As a result, the model identifies the exact location of the vulnerability rather than simply flagging the entire contract as unsafe.
Finally, large language models (AI systems trained on vast amounts of text) generate structured reports: the type of error, its location, the cause, possible consequences and how to fix it. These capabilities were then transferred to compact models that run on ordinary hardware.
On 242 real contracts, HCA-SGNN outperformed existing detection methods and general-purpose language models fine-tuned for the same task. It also identified several types of vulnerabilities that were not present in the training data. The compact explanation models achieved roughly 97-98% of the quality of large commercial models.
The researchers see applications for the system in pre-release security audits, developer tools and faster, cheaper verification of blockchain financial services. "For AI to be truly useful in security, people must understand why it raises an alarm. Our system points to the specific dangerous part of the program and explains the risk in plain language. We believe that such explainable AI is the key to building software that can be trusted," Professor Nguyen concludes.