What's this about?
Smart contract projects publish their source on blockchain explorers to build trust with users and investors — verification is the norm and the whole point. This paper observes that the same published source is now the input to LLM-based vulnerability scanners run by attackers, and proposes defenses.
Why is this an unusually pure version of the problem?
Because the transparency is not optional or accidental — it is the product. A smart contract holds money, is immutable once deployed, and asks strangers to trust it, which is why verified source is the standard. The same properties that make verification necessary make an automated attacker's job easy: complete source, a fixed target that cannot be patched, and a direct financial payoff for whoever finds the bug first. It is the clearest instance of AI compressing the window between disclosure and exploitation.
Why does this matter to you?
- It is a concrete case of the asymmetry the industry keeps discussing: scanning got cheap for everyone, including the attacker.
- The generalised lesson applies well beyond blockchain — any open-source project is now continuously scanned by whoever cares to.
- It argues for finding your own bugs first as the only viable posture, which is the same argument the collective cyberdefense letter makes.