ASE 2026
Mon 12 - Fri 16 October 2026 Munich, Germany

The rapid adoption of blockchain technology highlighted the importance of ensuring the security of smart contracts due to their critical role in automated business logic execu- tion on blockchain platforms. This paper provides an empirical evaluation of automated vulnerability analysis tools specifically designed for Solidity smart contracts. Leveraging the extensive SmartBugs 2.0 framework, which includes 20 analysis tools, we conducted a comprehensive assessment using an annotated dataset of 2,182 instances, manually la- beled at the line level with vulnerability labels. Our evaluation highlights the detection effectiveness of these tools in detecting various types of vulnerabilities, as categorized by the DASP TOP 10 taxonomy. We evaluated the efficacy of a Large Language Model-based detection method on two popular datasets. In this case, we obtained inconsistent results with the two datasets, showing unreliable detection when analyzing real-world smart con- tracts. Our study identifies significant variations in the accuracy and reliability of differ- ent tools and demonstrates the advantages of combining multiple detection methods to improve vulnerability identification. We identified a set of 3 tools that, combined, achieve up to 76.78% found vulnerabilities, taking less than one minute to run, on average. This study contributes to the field by releasing the largest dataset of manually analyzed smart contracts with line-level vulnerability annotations and by conducting the largest empirical evaluation of tools to date.

Thu 15 Oct

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

10:30 - 12:30
Security and Other Non-Functional Properties: Security and Privacy 6Research Papers / Tools and Datasets / Journal First at Forum 2
Chair(s): Tegan Brennan Stevens Institute of Technology
10:30
15m
Talk
An empirical analysis of vulnerability detection tools for solidity smart contracts
Journal First
Francesco Salzano University of Molise, Cosmo Kevin Antenucci University of Molise, Simone Scalabrino University of Molise, Giovanni Rosa JetBrains, Rocco Oliveto University of Molise, Remo Pareschi University of Molise
DOI
10:45
15m
Research paper
SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and ExecutionACM SIGSOFT Distinguished Paper Award
Research Papers
Longfei Chen Tsinghua University, China, Ruibin Yan Peking University, Taiyu Wong Tsinghua University, Yiyang Chen Tsinghua University, Wang Jialai National University of Singapore, Chao Zhang Tsinghua University
11:00
15m
Talk
Zero-Knowledge VMs: Security and Usability in Practice
Research Papers
Jinan Jiang The Hong Kong Polytechnic University, Jinzhao Chu , Pengyu Xue Hong Kong Polytechnic University, Xinghao Peng , Haoran Qin The Hong Kong Polytechnic University, Xiapu Luo Hong Kong Polytechnic University
11:15
10m
Talk
GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts
Tools and Datasets
Luca Olivieri University Ca' Foscari, Venice, Luca Negrini Ca’ Foscari University of Venice, Vincenzo Arceri University of Parma, Italy, Pietro Ferrara Ca’ Foscari University of Venice, Fausto Spoto University of Verona, Italy, Agostino Cortesi Ca’ Foscari University of Venice
DOI Media Attached
11:25
15m
Talk
MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning
Research Papers
Shenao Wang Huazhong University of Science and Technology, HeJunjie , Yanjie Zhao Huazhong University of Science and Technology, Yayi Wang Ant Group, Kan Yu Ant Group, Haoyu Wang Huazhong University of Science and Technology
11:40
15m
Talk
LARA: Static ReDoS Detection for Regular Expressions with Lookahead via Matching Automata
Research Papers
Mengxi Wang Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Chengyao Peng Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Weihao Su ISCAS, Guiyi He Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Rongchen Li Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, hong huang Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Haiming Chen Institute of Software, Chinese Academy of Sciences
11:55
15m
Talk
How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study
Research Papers
Zhihao Chen Fujian Normal University, Ying Zhang Wake Forest University, Yi Liu Griffith University, Gelei Deng Nanyang Technological University, Yuekang Li UNSW Sydney, Yanjun Zhang Deakin University, Jianting Ning Zhejiang Sci-Tech University, Leo Zhang Griffith University, Lei Ma The University of Tokyo & University of Alberta, Zhiqiang Li Independent Researcher
12:10
10m
Talk
AIALIB: A Threat Library for AI-Generated Code
Tools and Datasets
Ali Aljaberi MBZUAI, Jian Kang MBZUAI, Youcheng Sun MBZUAI
DOI
12:20
10m
Talk
Cochise: A Reference Harness for Autonomous Penetration Testing
Tools and Datasets
Andreas Happe TU Wien, Jürgen Cito TU Wien
DOI Pre-print