DeepDesc: integrating retrieval-augmented generation with large language models for smart contract vulnerability detection
摘要
With the rapid advancement of blockchain technology, the security of smart contracts has become increasingly critical. Most existing automated tools focus on detecting vulnerabilities based on fixed patterns, making it difficult to identify complex business logic flaws—over 80% of which remain undetected. To address this gap, we propose DeepDesc, a novel framework for smart contract vulnerability detection that integrates Retrieval-Augmented Generation (RAG) with large language models (LLMs) and deep learning. DeepDesc employs GPT-3.5-turbo enhanced by RAG to generate high-quality code descriptions using 1,201 real-world vulnerability reports from Code4Rena. These descriptions, combined with the code, are used to train a deep learning classifier using Multimodal Low-rank Bilinear (MLB) pooling. Our method effectively handles both machine-auditable bugs (MABs) and machine-unauditable bugs (MUBs). Experimental results show that DeepDesc achieves an average F1 score of 1.00 for MABs and 0.90 for MUBs, significantly outperforming existing techniques.