Automated Vulnerability Detection in Smart Contracts Using AI

Abstract

Traditional smart contract vulnerability detection relies on rule-based static analysers that check for known patterns, or on symbolic execution tools that explore execution paths exhaustively. Both approaches struggle with novel vulnerability types that do not match existing rules and with complex contracts where path explosion makes exhaustive exploration infeasible. AI-based detection -- using deep learning models trained on labelled vulnerable and safe contracts -- promises to generalise beyond known patterns and scale to arbitrary contract complexity. But how well does it actually work, and where does it fall short? I present the AI-Powered Smart Contract Vulnerability Detection Framework (AISCVDF), evaluating five AI architectures -- graph neural networks on control flow graphs, transformer models on source code, bytecode sequence models, hybrid GNN-transformer pipelines, and LLM-based zero-shot detection -- on a curated dataset of 18,400 Solidity contracts with ground-truth vulnerability labels. The AI Detection Quality Score (ADQS) measures precision, recall, generalisation to unseen vulnerability types, explanation quality, and computational cost. Key finding: GNN-transformer hybrids achieve the highest ADQS (0.904) with 91.8% recall and 89.4% precision, but LLM zero-shot detection -- requiring no training data at all -- reaches 82.4% recall, making it a viable first-pass tool for projects without labelled datasets.