kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Do Automated Fixes Truly Mitigate Smart Contract Exploits?
KTH, School of Electrical Engineering and Computer Science (EECS), Theoretical Computer Science.ORCID iD: 0000-0003-3116-3278
KTH, School of Electrical Engineering and Computer Science (EECS), Theoretical Computer Science.ORCID iD: 0009-0000-8775-2093
KTH, School of Electrical Engineering and Computer Science (EECS), Theoretical Computer Science.ORCID iD: 0000-0003-3505-3383
2026 (English)In: IEEE Transactions on Software Engineering, ISSN 0098-5589, E-ISSN 1939-3520, Vol. 52, no 1, p. 100-115Article in journal (Refereed) Published
Abstract [en]

Automated Program Repair (APR) for smart contract security promises to automatically mitigate smart contract vulnerabilities responsible for billions in financial losses. However, the true effectiveness of this research in addressing smart contract exploits remains uncharted territory. This paper bridges this critical gap by introducing a novel and systematic experimental framework for evaluating exploit mitigation of program repair tools for smart contracts. We qualitatively and quantitatively analyze 20 state-of-the-art APR tools using a dataset of 143 vulnerable smart contracts, for which we manually craft 91 executable exploits. We are the very first to define and measure the essential "exploit mitigation rate", giving researchers and practitioners a real sense of effectiveness. Our findings reveal substantial disparities in the state of the art, with an exploit mitigation rate ranging from a low of 29% to a high of 74%. Our study identifies systemic limitations, such as inconsistent functionality preservation, that must be addressed in future research on program repair for smart contracts.

Place, publisher, year, edition, pages
Institute of Electrical and Electronics Engineers (IEEE) , 2026. Vol. 52, no 1, p. 100-115
Keywords [en]
Smart contracts, Maintenance engineering, Codes, Source coding, Blockchains, Prevention and mitigation, Manuals, Static analysis, Systematic literature review, Formal verification
National Category
Software Engineering
Identifiers
URN: urn:nbn:se:kth:diva-378268DOI: 10.1109/TSE.2025.3618123ISI: 001662933000004Scopus ID: 2-s2.0-105018366743OAI: oai:DiVA.org:kth-378268DiVA, id: diva2:2047171
Note

QC 20260319

Available from: 2026-03-19 Created: 2026-03-19 Last updated: 2026-03-19Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Bobadilla, SofiaJin, MonicaMonperrus, Martin

Search in DiVA

By author/editor
Bobadilla, SofiaJin, MonicaMonperrus, Martin
By organisation
Theoretical Computer Science
In the same journal
IEEE Transactions on Software Engineering
Software Engineering

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 36 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf