Yi Li | Associate Professor | NTU

Papers accepted by CCS 2026

2026-07-18T00:00:00-00:00

I am pleased to share that our paper has been accepted to the 33rd ACM Conference on Computer and Communications Security (CCS 2026)!

As Large Language Model (LLM) agents increasingly automate offensive operations across the cyber kill chain, their efficacy in complex local post-exploitation tasks remains inadequately quantified. Among these, Linux privilege escalation is a key step between initial access and full system compromise. However, existing evaluations for this task are heavily limited by small sample sizes (typically fewer than 15 scenarios), lacking the scale required to distinguish genuine reasoning from simple pattern memorization.

In this work, we present PrivEscalate [1], the most comprehensive benchmark to date for measuring LLM-automated Linux privilege escalation. Our benchmark comprises 531 Dockerized scenarios spanning 14 distinct sub-categories. To rigorously probe generalization, we additionally derive 154 parameterized variant scenarios that inject distractors and environmental noise to test whether LLMs genuinely reason about exploitation or merely rely on surface-level pattern matching.

Evaluating four closed-source and two open-weight LLMs, our findings demonstrate that:

Model capabilities are highly heterogeneous across vulnerability categories, with no single model dominating all areas, necessitating multi-dimensional risk assessments.
LLMs are fragile under environmental perturbation, with only one of six models successfully generalizing across variants, making configuration rotation a highly effective defense against most models.
Agent architectures can significantly amplify risk. We developed PrivEscAgent, a domain-specialized wrapper that augments a generic ReAct agent with deterministic enumeration, category matching, and step planning.
PrivEscAgent improves upon prior baselines (such as hackingBuddyGPT) by 34 percentage points and elevates the weakest evaluated model above that baseline without requiring any underlying LLM modifications.

We are releasing PrivEscalate as an open-source, Dockerized measurement instrument to support both LLM agent evaluation and broader Linux privilege escalation research.

Congratulations to Yixuan, Zilong, and Yin on this exciting achievement! Looking forward to presenting our work at CCS 2026.

References

Liu, Y., Zhen, Z., Wu, Y., & Li, Y. (2026, November). PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation. Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS).

Papers accepted by CCS 2026 was originally published by Yi Li at Yi Li | Associate Professor | NTU on July 18, 2026.

Papers accepted by ISSTA 2026

2026-06-26T00:00:00-00:00

We have three papers accepted at ISSTA’26:

EventSpec [1] introduces the first systematic study of event-semantic defects in smart contracts, uncovering vulnerabilities that arise when emitted events diverge from actual on-chain state. By automatically inferring event specifications and detecting semantic inconsistencies, EventSpec achieves over 90% precision on 6,552 real-world contracts and demonstrates practical attacks against wallets, bridges, explorers, and NFT marketplaces, leading to multiple confirmed vulnerability reports and bug bounties.
TrapHunter [2] tackles the growing threat of trap tokens—malicious token contracts that deceptively comply with standards while embedding hidden fraudulent behaviors. The framework combines program analysis, LLM-based intent reasoning, and dynamic validation to expose covert execution pathways and identify intent deviations from legitimate token implementations. Evaluations show that TrapHunter substantially outperforms existing approaches, achieving 81.8% precision and 85.4% recall across six categories of token traps.
RollGain [3] reveals a previously underexplored attack surface rooted in Ethereum’s rollback semantics. The framework synthesizes profit-driven rollback attacks on-chain and systematically tests off-chain systems for rollback misinterpretation vulnerabilities. Analyzing over 3 billion Ethereum transactions, RollGain achieves 95.3% recall with zero false positives and uncovers 20 vulnerabilities across blockchain explorers, token trackers, and RPC services, resulting in numerous confirmed fixes and CVE assignments.

Collectively, these three papers advance blockchain security beyond traditional smart contract logic bugs by exposing vulnerabilities that emerge at the intersection of on-chain execution semantics, developer intent, and off-chain ecosystem assumptions.

This year, ISSTA received 888 submissions and 90 papers were directly accepted. This leaves 128 papers for major revision and 120 were accepted after revision. The overall acceptance rate is 23.6%.

References

Liu, Y., Dong, Y., Liu, Y., Wu, Y., Zhang, C., Luo, X., & Li, Y. (2026, October). EventSpec: Defining and Detecting Event-Semantic Issues in Blockchain Ecosystems. Proceedings of the 35th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA).
Liu, Y., Li, X., & Li, Y. (2026, October). Exploiting Ethereum Rollback Semantics: Profit-Driven Attack Synthesis and Off-Chain Misinterpretation Testing. Proceedings of the 35th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA).
Wu, Y., Liu, Y., Li, Y., Peng, C., Wu, H., Fan, M., Liu, T., & Wang, H. (2026, October). TrapHunter: Exposing Covert Pathways in Trap Token Contracts. Proceedings of the 35th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA).

Papers accepted by ISSTA 2026 was originally published by Yi Li at Yi Li | Associate Professor | NTU on June 25, 2026.

Intent Reverse Engineering for Smart Contracts

2026-06-25T00:00:00-00:00

tl;dr: In the AI era, intent is becoming more important than code. Yet, for most software systems—including smart contracts—intent is rarely specified explicitly. Can we recover it from the artifacts that developers leave behind? Smart contracts provide a uniquely rich environment for this challenge because their code, execution histories, governance discussions, and audit reports are often publicly available. This post explores the emerging idea of intent reverse engineering: recovering formalized intent from these artifacts and transforming it into machine-readable specifications. Such capabilities may become a key building block for verification, auditing, maintenance, and AI-assisted software development.

disclaimer: this post is not meant to be a complete survey of the literature, rather to develop a conceptual framework that may help us think about future research directions.

Background

In the age of AI coding, intent is the new source code. Software development is rapidly shifting from code-centric to intent-centric workflows, where developers increasingly specify what they want and AI systems determine how to implement it. As a result, the central challenge is no longer writing code, but communicating intent precisely.

This shift exposes what recent work refers to as the intent gap [1]: the disconnect between human intentions and actual program behaviors. Natural-language requirements are often ambiguous, incomplete, or underspecified, allowing multiple plausible implementations that may satisfy the written description while violating the developer’s true intent. Formal specifications offer a promising way to bridge this gap by providing precise, machine-interpretable representations of intended behavior.

Unfortunately, writing formal specifications remains difficult and expensive. This is a well-known and long-standing challenge in practice: formal methods require specialized expertise, significant effort, and a level of rigor that many development teams cannot afford. As a result, most software systems are built without explicit formal specifications. Instead, their intended behavior is implicitly encoded across source code, documentation, design documents, issue trackers, test suites, code reviews, and developer discussions. Over time, as systems evolve and contributors change, this intent becomes increasingly fragmented and difficult to recover.

Why Reverse Engineering?

This motivates the problem of Intent Reverse Engineering: automatically recovering formalised intents from existing software systems and their surrounding artifacts. Rather than requiring developers to write specifications from scratch, intent reverse engineering techniques aim to infer behavioral constraints, invariants, domain assumptions, and other semantic properties directly from existing implementations, execution traces, documentation, and historical development records. In the AI era, such inferred specifications can serve as machine-readable representations of intent, enabling more reliable code generation, verification, testing, and maintenance.

The idea is not entirely new. Prior work has explored many forms of specification recovery, including dynamic invariant detection (e.g., Daikon), static contract inference (e.g., Houdini), API specification mining, protocol inference, and specification synthesis techniques that derive behavioral models from code and executions. These approaches have demonstrated that useful specifications can often be recovered automatically (or semi-automatically), even when no formal specification was originally available.

Intent reverse engineering, however, aims at a broader target. First, the available evidence extends beyond source code and execution traces to include documentation, commit histories, design discussions, code reviews, issue trackers, and other development artifacts. Second, the recovered intent is not limited to low-level program properties such as preconditions, postconditions, and invariants. Instead, we seek richer semantic structures, including domain models, business rules, security assumptions, governance policies, protocol constraints, and architectural decisions. The goal is not merely to describe what the software does, but to reconstruct why it was built that way in the first place.

Why Smart Contracts?

Smart contracts provide a particularly compelling setting for intent reverse engineering. Unlike traditional software, smart contracts often manage valuable digital assets, enforce governance mechanisms, and serve as the foundational infrastructure of decentralized applications. Errors in their behavior can lead to irreversible financial losses, making precise understanding of intent especially important.

At the same time, smart contracts are unusually transparent as their decentralized nature requires. Source code, deployment artifacts, transaction histories, audit reports, governance proposals, and public discussions are frequently available to anyone. This creates a rich ecosystem of heterogeneous artifacts that collectively encode developer intent. The challenge is not the absence of information, but rather the difficulty of integrating these sources into a coherent and machine-interpretable specification.

Another important reason is that smart contracts are relatively small and self-contained compared to most traditional software systems. Their state spaces and control flows are often simpler, and their behavior is typically expressed through explicit business logic rather than complex interactions with operating systems, user interfaces, or large external dependencies. As a result, many formal techniques that struggle to scale to conventional software become practical for smart contracts. Verification, invariant inference, symbolic reasoning, and specification mining can often be applied directly to real-world contracts, making the domain an attractive testbed for intent reverse engineering.

A Roadmap for Recovering Intent

In this post, I summarize our past work that can be viewed through the lens of intent reverse engineering for smart contracts and discuss several promising directions for future research.

The intent reverse engineering process is fundamentally about transforming a collection of heterogeneous artifacts into a representation of intent, which can be viewed as a three-stage pipeline:

Intent Sources → Intent Inference → Intent Representations

The following table organizes existing efforts in this space along two dimensions. The first dimension, intent sources, concerns where developer intent is encoded. Unlike traditional software systems, smart contracts are accompanied by a rich ecosystem of publicly available artifacts, ranging from source code and transaction histories to white papers, governance records, and audit reports. The second dimension, intent representations, concerns the form in which recovered intent is expressed. These representations span multiple levels of abstraction, from low-level behavioral specifications such as preconditions, postconditions, and invariants, to higher-level concepts such as security properties, and business rules. Together, these dimensions provide a useful framework for understanding both existing approaches and future opportunities in intent reverse engineering.

Dimension	Category	Examples
Intent Sources	Code-Centric	Source code, bytecode, CFGs, storage layouts, tests, user interfaces [2]
	Execution-Centric	Transaction histories, execution traces, event logs [3], [4], [5], [6]
	Documentation-Centric	Whitepapers, technical standards (e.g., ERC)
	Evolution-Centric	Commits, upgrade proposals (e.g., EIP), issue trackers [7]
	Community-Centric	Audit reports [8]
Intent Representations	Behavioral Specifications	Preconditions, postconditions, invariants [3], [4]
	State Machines	Protocol states and transitions [9]
	Security Properties	Authorization rules, role structures, security policies, trust assumptions [10]
	Business Rules	Governance structures, incentive mechanisms [11], tokenomics, business logics [12], game rules [13]

Case Studies

To make these ideas more concrete, let us examine several examples of how intent can be recovered from different artifacts and represented in different forms. While these works were not originally framed as intent reverse engineering, they can be naturally viewed as concrete instantiations of the roadmap described above.

Case Study 1: Recovering Behavioral Specifications from Execution Histories

Among the various sources of intent discussed earlier, execution histories provide perhaps the most direct evidence of how a smart contract is expected to behave in practice. Every successful transaction reflects a sequence of actions that satisfied the contract’s checks, respected its business logic, and produced outcomes accepted by both users and the blockchain. Collectively, these transactions encode a rich record of the behavioral assumptions under which the contract operates.

This observation motivates a simple but powerful idea: if intent is not explicitly documented, perhaps it can be inferred from observed behavior. Rather than asking developers to write specifications manually, we can analyze historical transactions and execution traces to recover behavioral properties that appear to hold consistently during contract operation. Such properties may reveal implicit preconditions, postconditions, state invariants, and relationships among contract variables, providing a machine-readable approximation of the contract’s intended behavior.

Along this line, we developed InvCon [4] and its successor InvCon+ [3], which infer behavioral specifications from transaction histories and execution traces. The recovered specifications capture properties such as preconditions, postconditions, and state invariants, transforming implicit behavioral assumptions into explicit and machine-readable representations (see examples below).

Common ERC-20 invariants inferred by InvCon+

InvCon adopts a dynamic invariant detection approach similar to Daikon, mining likely invariants from observed executions based on predefined templates. InvCon+ extends this approach by combining dynamic inference with static analysis and formal verification, allowing candidate invariants to be validated against the contract implementation and enabling the discovery of specifications beyond those directly observable from historical traces.

Viewed through the lens of intent reverse engineering, these systems recover behavioral specifications from execution-centric artifacts. The inferred invariants provide a machine-readable approximation of the assumptions that developers expect to hold throughout contract execution.

An important question, however, is whether such recovered specifications are actually useful. In our subsequent work [5], we conducted the first systematic study of invariant effectiveness against real-world DeFi attacks. The results show that a substantial fraction of attacks manifest as violations of inferred invariants, suggesting that these specifications capture meaningful aspects of protocol intent. Beyond their role in documentation and program understanding, recovered behavioral specifications can therefore serve as practical security monitors for detecting deviations from intended behavior.

Case Study 2: Recovering Domain Models to Support Security Intent

Behavioral specifications such as invariants and preconditions capture how a contract behaves. However, many important forms of intent cannot be expressed solely in terms of state variables and transaction effects. Security requirements often depend on the broader domain context in which a contract operates. Questions such as “what roles exist within the system?”, “who is allowed to perform a particular action?”, and “what constitutes a valid game move?” require an understanding of the domain model underlying the contract.

This observation motivates a second form of intent reverse engineering: recovering the semantic structures that define the environment in which contract behaviors should be interpreted. Rather than directly inferring behavioral properties, the goal is to reconstruct concepts such as role hierarchies, authorization relationships, protocol participants, and game rules. These domain models provide the foundation upon which higher-level security and business specifications can be expressed.

Our work on SpCon [10] illustrates this idea. Access-control vulnerabilities remain one of the most common causes of smart contract exploits, yet authorization policies are rarely documented explicitly. Instead, role relationships are implicitly encoded through permission checks scattered across contract functions. SpCon analyzes contract code and benign past transactions to recover a role-based model of the system, identifying privileged entities, protected operations, and the relationships between them. Once this role structure is reconstructed, high-level authorization specifications can be formulated and checked automatically. For example, the system can reason about whether sensitive operations are restricted to intended administrators, whether privilege escalation paths exist, or whether different roles are granted inconsistent permissions. In this sense, the recovered role model serves as a machine-readable representation of the contract’s security intent.

A similar perspective appears in our work on specification mining for smart contracts [13], [9]. Many contracts implement application-specific protocols whose correctness depends on domain-specific rules rather than generic invariants. Consider blockchain-based games, auctions, or governance systems. Properties such as a player may only move after joining the game, a winner can only be declared after the game ends, or a bid must exceed the current highest bid are meaningful only when interpreted within the protocol’s state machine and participant model. To recover such specifications, we analyze execution traces using trace slicing and predicate abstraction techniques, extracting higher-level behavioral rules that describe interactions among participants and protocol states (see an example below). The resulting specifications capture not merely low-level program behavior, but the game rules and operational semantics that define the application’s intended functionality.

Game rules mined from an Ethereum dice game called Dicether

Viewed through the lens of intent reverse engineering, both systems recover domain models from code-centric and execution-centric artifacts. These models act as an intermediate layer between implementation details and high-level intent. Rather than directly inferring security policies or business rules, they reconstruct the semantic vocabulary needed to express such concepts in the first place. Once the role structures, protocol states, and interaction patterns are recovered, richer specifications can be formulated, verified, and monitored automatically.

More broadly, these examples suggest that intent recovery may benefit from a hierarchical process. Before recovering high-level intent, we may first need to recover the conceptual models that developers implicitly assume when designing the system. In many cases, understanding the domain may be a prerequisite for understanding the intent itself.

AI’s Role in Intent Recovery

Most of the techniques discussed so far rely on structured artifacts such as source code, execution traces, and transaction histories. While these artifacts provide valuable signals about program behavior, they represent only a fraction of the information that developers and communities use to communicate intent. Much of a protocol’s rationale, governance structure, economic assumptions, and security expectations are documented in natural-language artifacts such as whitepapers, governance proposals, audit reports, technical discussions, and community forums.

Historically, these sources have been difficult to utilize systematically. Unlike program code, natural-language documents are often ambiguous, incomplete, and highly domain-specific. As a result, traditional specification mining techniques have largely focused on artifacts that can be analyzed using static analysis, dynamic analysis, or formal reasoning.

Recent advances in large language models fundamentally change this landscape. Modern AI systems possess strong capabilities in code understanding, natural-language comprehension, information extraction, summarization, and cross-document reasoning. These capabilities make it possible to recover intent from sources that were previously inaccessible to automated analysis, significantly broadening the scope of intent reverse engineering.

One example comes from our work on governance analysis in decentralized finance [11]. Governance mechanisms define many of the most important business rules of a protocol, including voting rights, ownership structures, reward distributions, and decision-making procedures. Such rules are often described primarily in whitepapers and governance documents rather than encoded directly in smart contract logic. By leveraging large language models, we were able to automatically extract governance-related information from protocol documentation and reconstruct governance structures at scale. The resulting representations capture high-level organizational intent that would be difficult, if not impossible, to recover through code analysis alone.

Beyond extracting intent from unstructured artifacts, AI also enables a second capability: intent transfer. Human developers frequently reuse design patterns, business models, and security mechanisms across projects. Consequently, many forms of intent are not unique to a single system but recur across families of similar applications. Rather than inferring specifications entirely from scratch, AI systems can leverage previously recovered knowledge and adapt it to new contexts.

This idea is illustrated by our work on PropertyGPT [8]. The key observation is that security auditors routinely write high-quality formal specifications when verifying smart contracts. These specifications encode valuable expert knowledge about common business rules, security assumptions, and protocol behaviors. PropertyGPT retrieves specifications from previously audited contracts and uses large language models to adapt them to new contracts with similar structures and functionalities. In effect, the system treats existing specifications as reusable intent artifacts and performs intent transfer across related protocols.

Viewed through the lens of intent reverse engineering, AI is not merely another inference technique. Rather, it expands both the sources from which intent can be recovered and the mechanisms by which intent can be propagated. Instead of relying solely on structured program artifacts, future systems may synthesize evidence from code, executions, documentation, governance discussions, audit reports, and historical specifications. Likewise, instead of recovering intent independently for every project, they may continuously accumulate, refine, and transfer intent knowledge across entire software ecosystems.

This shift suggests a broader vision for the future. If traditional specification mining can be viewed as recovering intent from a single artifact, AI-driven intent recovery may ultimately become a knowledge-centric process that integrates information across heterogeneous sources and reuses intent across related systems. Such capabilities could transform intent from a scarce and manually produced resource into a reusable asset that evolves alongside software itself.

Future Directions

The vision of intent reverse engineering is still in its early stages. Looking ahead, several open research questions appear particularly promising.

1. Multi-Level and Multi-Source Intent Fusion

Current approaches typically recover fragments of intent from individual artifacts, such as source code, execution traces, documentation, or governance discussions. At the same time, intent exists at multiple levels of abstraction, ranging from function-level behavioral contracts to high-level business objectives. A key challenge is to integrate intent across both different sources and different abstraction levels into a coherent and unified specification. This raises fundamental questions:

How should conflicting evidence be reconciled when different artifacts suggest different intentions?
How can low-level behavioral constraints be connected to high-level business goals?

Addressing these challenges will likely require new techniques for evidence integration, uncertainty modeling, and cross-level reasoning about intent.

2. Human-in-the-Loop Intent Recovery

Automatically recovered intent may not always be accurate or complete. In many cases, different artifacts may provide ambiguous or even conflicting signals, and purely automated systems may struggle to resolve these discrepancies. This suggests the need for human-in-the-loop approaches, where developers, auditors, or domain experts actively participate in the intent recovery process. Key questions include:

How can we design systems that effectively incorporate human feedback into intent inference?
How should recovered intent be presented to users to support validation, correction, and refinement?

Rather than fully automating intent recovery, future systems may combine automated inference with interactive tools that allow humans to guide, validate, and refine the recovered specifications.

3. Intent Evolution

Intent is not static. Smart contracts are upgraded, governance decisions modify protocol objectives, and communities redefine acceptable behavior over time. This perspective aligns with earlier work [14], which emphasizes the role of change intention in understanding how software evolves.This raises an important question:

How can we track the evolution of intent across protocol lifecycles?

Understanding intent drift and intent evolution remains largely unexplored and aligns naturally with the evolution-centric sources discussed earlier.

4. Intent-Centric Software Engineering

More broadly, intent reverse engineering points toward a larger shift in software engineering. As AI increasingly automates implementation, software development may become fundamentally centered on intent management rather than code production.

In such a world, intent reverse engineering is no longer merely a maintenance activity. It becomes an essential mechanism for recovering, validating, and evolving the specifications that govern software systems. Smart contracts, with their rich collection of public artifacts and strong correctness requirements, provide a unique opportunity to pioneer this transition toward intent-centric software engineering.

References

Lahiri, S. K. (2026). Intent Formalization: A Grand Challenge for Reliable Coding in the Age of AI Agents. ArXiv Preprint ArXiv:2603.17150.
Liu, Y., Li, X., & Li, Y. (2025, November). DeepTx: Real-Time Transaction Risk Analysis via Multi-Modal Features and LLM Reasoning. Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE).
Liu, Y., Zhang, C., & Li, Y. (2025). Automated Invariant Generation for Solidity Smart Contracts. IEEE Transactions on Dependable and Secure Computing.
Liu, Y., & Li, Y. (2022). InvCon: A Dynamic Invariant Detector for Ethereum Smart Contracts. Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering (ASE), 1–4.
Chen, Z., Liu, Y., Beillahi, S. M., Li, Y., & Long, F. (2024). Demystifying Invariant Effectiveness for Securing Smart Contracts. Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering (FSE), 1772–1795.
Chen, Z., Liu, Y., Beillahi, S. M., Li, Y., & Long, F. (2024). OpenTracer: A Dynamic Transaction Trace Analyzer for Smart Contract Invariant Generation and Beyond. Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2399–2402.
Liu, Y., Li, S., Wu, X., Li, Y., Chen, Z., & Lo, D. (2024). Demystifying the characteristics for smart contract upgrades. ArXiv Preprint ArXiv:2406.05712.
Liu, Y., Xue, Y., Wu, D., Sun, Y., Li, Y., Shi, M., & Liu, Y. (2025, February). PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation. Proceedings of 32nd Annual Network and Distributed System Security Symposium (NDSS).
Liu, Y., Liu, Y., Li, Y., & Artho, C. (2025, March). Specification Mining for Smart Contracts with Trace Slicing and Predicate Abstraction. Proceedings of the 32nd IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER).
Liu, Y., Li, Y., Lin, S.-W., & Artho, C. (2022). Finding Permission Bugs in Smart Contracts with Role Mining. Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 716–727.
Ma, W., Zhu, C., Liu, Y., Xie, X., & Li, Y. (2025). A Comprehensive Study of Governance Issues in Decentralized Finance Applications. ACM Transactions on Software Engineering and Methodology, 34(7), 1–31.
Gao, J., Zhang, Z., Sun, Y., Liu, Y., Liu, C., Liu, H., Li, Y., & Liu, Y. (2026). LogicScan: An LLM-driven Framework for Detecting Business Logic Vulnerabilities in Smart Contracts. ArXiv Preprint ArXiv:2602.03271.
Liu, Y., Li, Y., Lin, S.-W., & Zhao, R. (2020). Towards Automated Verification of Smart Contract Fairness. Proceedings of the 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), 666–677.
Krüger, J., Li, Y., Zhu, C., Chechik, M., Berger, T., & Rubin, J. (2023). A Vision on Intentions in Software Engineering. Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), 2117–2121.

Intent Reverse Engineering for Smart Contracts was originally published by Yi Li at Yi Li | Associate Professor | NTU on June 25, 2026.

Papers accepted by ASE 2026

2026-06-18T00:00:00-00:00

Thrilled to share that our paper has been accepted to the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE 2026)! This year, ASE received 1304 submissions, with 115 papers directly accepted.

As the TON blockchain continues to grow, analyzing TVM bytecode remains challenging due to its unique continuation mechanism and savelist-based register preservation, which allows data to flow across continuation boundaries without traversing the operand stack. Existing bytecode analyses therefore miss important cross-continuation data flows.

In this work, we present TasmScan [1], the first bytecode-level static analysis framework for TVM that performs continuation-aware taint analysis directly on bytecode without requiring source code. TasmScan models savelist semantics through a sound register analysis, lifts TVM bytecode into a typed intermediate representation (TASIR), and performs path-sensitive taint analysis with context-aware sources to detect security defects.

Our evaluation on 2,921 real-world TON smart contracts and a 208-contract benchmark with human-confirmed ground truth demonstrates that TasmScan:

Resolves 294,546 dynamic continuation targets with 100% precision.
Achieves 95.3% recall and 96.8% precision across five defect classes on the benchmark.
Estimates 85.8% precision on a stratified sample from the full corpus.
Delivers a 17× median speedup over the state-of-the-art symbolic-execution baseline while completing 100% of analyses with zero crashes or timeouts.

Congratulations to Yixuan and Yin on this exciting achievement! Looking forward to presenting our work at ASE 2026.

References

Liu, Y., Wu, Y., & Li, Y. (2026, October). TasmScan: Continuation-Aware Taint Analysis for TVM Bytecode with Savelist Abstraction. Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE).

Papers accepted by ASE 2026 was originally published by Yi Li at Yi Li | Associate Professor | NTU on June 18, 2026.

Papers accepted by ASE 2025

2025-09-26T00:00:00-00:00

We have three technical papers and a tool demonstration paper accepted at ASE’25:

Defects4C [1]: The first major benchmark for evaluating LLMs on fixing real-world C/C++ bugs, closing a crucial gap in automated program repair.
DeFiScope [2]: An LLM-powered detector that finds DeFi price manipulation attacks with 96% precision, uncovering 81 previously unknown incidents.
Co^2FuLL [3]: Makes binary code analysis accurate and explainable by fusing context with content and using LLMs for verification, boosting precision by 142.5%.
DeepTx [4]: A real-time Web3 transaction shield that uses multi-modal LLM reasoning to stop phishing attacks before they happen.

DeepTx is open-source and a video demostration can be found below:

DeepTx Demo Video

This year, ASE received 1190 submissions and 1136 were remaining after desk rejection. Out of the 1136 submissions, 113 papers were directly accepted and 132 were accepted after major revisions, which gives an overall acceptance rate of 21.6%.

References

Wang, J., Xie, X., Hu, Q., Liu, S., Yu, J., Kong, J., & Li, Y. (2025, November). Defects4C: Benchmarking Large Language Model Repair Capability with C/C++ Bugs. Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE).
Zhong, J., Wu, D., Liu, Y., Xie, M., Liu, Y., Li, Y., & Liu, N. (2025, November). Detecting Various DeFi Price Manipulations with LLM Reasoning. Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE).
Dong, C., Guo, J., Yang, S., Li, Y., Fang, D., Xiao, Y., Chen, Y., & Sun, L. (2025, November). Advancing Binary Code Similarity Detection via Context-Content Fusion and LLM Verification. Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE).
Liu, Y., Li, X., & Li, Y. (2025, November). DeepTx: Real-Time Transaction Risk Analysis via Multi-Modal Features and LLM Reasoning. Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE).

Papers accepted by ASE 2025 was originally published by Yi Li at Yi Li | Associate Professor | NTU on September 26, 2025.

Paper accepted by ISSTA 2025

2025-06-14T00:00:00-00:00

A paper [1] in collaboration with Xiufeng Xu (my PhD student), Fuman Xie, Chenguang Zhu, Guangdong Bai, and Sarfraz Khurshid was accepted at ISSTA’25. A summary of the paper is below:

Modern AI- and Data-intensive software systems rely heavily on data science and machine learning libraries that provide essential algorithmic implementations and computational frameworks. These libraries expose complex APIs whose correct usage has to follow constraints among multiple interdependent parameters. Developers using these APIs are expected to learn about the constraints through the provided documentation and any discrepancy may lead to unexpected behaviors. However, maintaining correct and consistent multi- parameter constraints in API documentation remains a significant challenge for API compatibility and reliability. To address this challenge, we propose MPChecker for detecting inconsistencies between code and documentation, specifically focusing on multi-parameter constraints. MPChecker identifies these constraints at the code level by exploring execution paths through symbolic execution and further extracts corresponding constraints from documentation using large language models (LLMs). We propose a customized fuzzy constraint logic to reconcile the unpredictability of LLM outputs and detect logical inconsistencies between the code and documentation constraints. We collected and constructed two datasets from four popular data science libraries and evaluated MPChecker on them. The results demonstrate that MPChecker can effectively detect inconsistency issues with the precision of 92.8%. We further reported 14 detected inconsistency issues to the library developers, who have confirmed 11 issues at the time of writing.

This year, 107 out of 550 submissions were accepted at ISSTA, which gives an acceptance rate of 19.4%.

References

Xu, X., Xie, F., Zhu, C., Bai, G., Khurshid, S., & Li, Y. (2025, June). Identifying Multi-Parameter Constraint Errors in Python Data Science Library API Documentations. Proceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA).

Paper accepted by ISSTA 2025 was originally published by Yi Li at Yi Li | Associate Professor | NTU on March 30, 2025.

Won Distinguished Paper Award at NDSS'25

2025-02-27T00:00:00-00:00

Our paper, “PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation” [1], have won a Distinguished Paper Award at NDSS’25.

References

Liu, Y., Xue, Y., Wu, D., Sun, Y., Li, Y., Shi, M., & Liu, Y. (2025, February). PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation. Proceedings of the 32nd Annual Network and Distributed System Security Symposium (NDSS).

Won Distinguished Paper Award at NDSS'25 was originally published by Yi Li at Yi Li | Associate Professor | NTU on February 27, 2025.

Paper accepted by ICSE 2025

2024-11-03T00:00:00-00:00

A paper [1] in collaboration with Lezhi Ma, Shangqing Liu, Xiaofei Xie, and Lei Bu was accepted at ICSE’25. A summary of the paper is below:

In the software development process, formal program specifications play a crucial role in various stages, including requirement analysis, software testing, and verification. However, manually crafting formal program specifications is rather difficult, making the job time-consuming and labor-intensive. Moreover, it is even more challenging to write specifications that correctly and comprehensively describe the semantics of complex programs. To reduce the burden on software developers, automated specification generation methods have emerged. However, existing methods usually rely on predefined templates or grammar, making them struggle to accurately describe the behavior and functionality of complex real-world programs.

To tackle this challenge, we introduce SpecGen, a novel technique for formal program specification generation based on Large Language Models (LLMs). Our key insight is to overcome the limitations of existing methods by leveraging the code comprehension capability of LLMs. The process of SpecGen consists of two phases. The first phase employs a conversational approach that guides the LLM to generate appropriate specifications for a given program, aiming to utilize the ability of LLM to generate high-quality specifications. The second phase, designed for where the LLM fails to generate correct specifications, applies four mutation operators to the model-generated specifications and selects verifiable specifications from the mutated ones through a novel heuristic selection strategy by assigning different weights of variants in an efficient manner. We evaluate SpecGen on two datasets, including the SV-COMP Java category benchmark and a manually constructed dataset containing 120 programs. Experimental results demonstrate that SpecGen succeeds in generating verifiable specifications for 279 out of 385 programs, outperforming the existing LLM-based approaches and conventional specification generation tools like Houdini and Daikon. Further investigations on the quality of generated specifications indicate that SpecGen can comprehensively articulate the behaviors of the input program.

References

Ma, L., Liu, S., Li, Y., Xie, X., & Bu, L. (2025, April). SpecGen: Automated Generation of Formal Program Specifications via Large Language Models. Proceedings of the 47th International Conference on Software Engineering (ICSE).

Paper accepted by ICSE 2025 was originally published by Yi Li at Yi Li | Associate Professor | NTU on November 03, 2024.

Papers accepted by ASE 2024

2024-08-10T00:00:00-00:00

We have a technical paper [1] and a tool demonstration paper [2] accepted at ASE’24. The first paper presents an empirical study evaluating existing AIGC detectors in the software domain. Despite its potential, the misuse of LLMs, especially in security and safety-critical domains, such as academic integrity and answering questions on Stack Overflow, poses significant concerns. In the second paper, we introduce OpenTracer, which offers comprehensive tracking of complete transaction information to extract user-desired data such as invariant-related data. OpenTracer has been employed to analyze 350,800 Ethereum transactions, successfully inferring 23 different types of invariant from predefined templates. OpenTracer is open-source and a video demostration can be found below.

OpenTracer Demo Video

This year, 118 out of 587 submissions were accepted (another 37 were conditionally accepted) at ASE, which gives an acceptance rate of 27.3%.

References

Wang, J., Liu, S., Xie, X., & Li, Y. (2024). An Empirical Study to Evaluate AIGC Detectors on Code Content. Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), 844–856.
Chen, Z., Liu, Y., Beillahi, S. M., Li, Y., & Long, F. (2024). OpenTracer: A Dynamic Transaction Trace Analyzer for Smart Contract Invariant Generation and Beyond. Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2399–2402.

Papers accepted by ASE 2024 was originally published by Yi Li at Yi Li | Associate Professor | NTU on August 08, 2024.

Paper accepted by FSE 2024

2024-04-15T00:00:00-00:00

A paper [1] in collaboration with Zhiyang Chen, Ye Liu, Sidi Mohamed Beillahi, and Fan Long was accepted at FSE’24. A summary of the paper is below:

Smart contract transactions associated with security attacks often exhibit distinct behavioral patterns compared with historical benign transactions before the attacking events. While many runtime monitoring and guarding mechanisms have been proposed to validate invariants and stop anomalous transactions on the fly, the empirical effectiveness of the invariants used remains largely unexplored. In this paper, we studied 23 prevalent invariants of 8 categories, which are either deployed in high-profile protocols or endorsed by leading auditing firms and security experts. Using these well-established invariants as templates, we developed a tool which dynamically generates new invariants customized for a given contract based on its historical transaction data. We evaluated our tool on 42 smart contracts that fell victim to 27 distinct exploits on the Ethereum blockchain. Our findings reveal that the most effective invariant guard alone can successfully block 18 of the 27 identified exploits with minimal gas overhead. Our analysis also shows that most of the invariants remain effective even when the experienced attackers attempt to bypass them. Additionally, we explored the possibility of combining multiple invariant guards, resulting in enhanced true positive rates and reduced false positive rates.

References

Chen, Z., Liu, Y., Beillahi, S. M., Li, Y., & Long, F. (2024). Demystifying Invariant Effectiveness for Securing Smart Contracts. Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering (FSE), 1772–1795.

Paper accepted by FSE 2024 was originally published by Yi Li at Yi Li | Associate Professor | NTU on April 15, 2024.

Paper accepted by ACM Computing Surveys

2024-04-03T00:00:00-00:00

A paper [1] in collaboration with Jacob Krüger, Kirill Lossev, Chenguang Zhu, Marsha Chechik, Thorsten Berger, and Julia Rubin was accepted by ACM Computing Surveys. A quick summary of the paper is given below.

Every software system undergoes changes, for example, to add new features, fix bugs, or refactor code. The importance of understanding software changes has been widely recognized, resulting in various techniques and studies, for instance, on change-impact analysis or classifying developers’ activities. Since changes are triggered by developers’ intentions—something they plan or want to change in the system, many researchers have studied intentions behind changes. While there appears to be a consensus among software-engineering researchers and practitioners that knowing the intentions behind software changes is important, it is not clear how developers can actually benefit from this knowledge. In fact, there is no consolidated, recent overview of the state-of-the-art on software-change intentions (SCIs) and their relevance for software engineering. We present a meta-study of 122 publications, which we used to derive a categorization of SCIs; and to discuss motivations, evidence, and techniques relating to SCIs. Unfortunately, we found that individual pieces of research are often disconnected from each other because a common understanding is missing. Similarly, some publications showcase the potential of knowing SCIs, but more substantial research to understand the practical benefits of knowing SCIs is needed. Our contributions can help researchers and practitioners improve their understanding of SCIs and how SCIs can aid software engineering tasks.

References

Krüger, J., Li, Y., Lossev, K., Zhu, C., Chechik, M., Berger, T., & Rubin, J. (2024). A Meta-Study of Software-Change Intentions. ACM Computing Surveys, 56(12), 1–41.

Paper accepted by ACM Computing Surveys was originally published by Yi Li at Yi Li | Associate Professor | NTU on April 03, 2024.

Paper accepted by INFOCOM 2024

2023-12-01T00:00:00-00:00

Xiaodong Qi’s paper [1] was accepted at INFOCOM. A quick summary of the paper is given below.

Sharding is a prevailing solution to enhance the scalability of current blockchain systems. However, the cross-shard commit protocols adopted in these systems to commit cross-shard transactions commonly incur multi-round shard-to-shard communication, leading to low performance. Furthermore, most solutions only focus on simple transfer transactions without supporting complex smart contracts, preventing sharding from widespread applications. In this paper, we propose LightCross, a novel blockchain sharding system that enables efficient execution of complex cross-shard smart contracts. First, LightCross offloads the execution of cross-shard transactions into off-chain executors equipped with the TEE hardware, which can accommodate execution for arbitrarily complex contracts. Second, we design a lightweight cross-shard commit protocol to commit cross-shard transactions without multi-round shard-to-shard communication between shards. Last, LightCross lowers the cross-shard transaction ratio by dynamically changing the distribution of contracts according to historical transactions. We implemented the LightCross prototype based on the FISCO-BCOS project and evaluated it in real-world blockchain environments, showing that LightCross can achieve 2.6× more throughput than state-of-the-art sharding systems.

This year, 256 out of 1307 submissions were accepted at INFOCOM, which gives an acceptance rate of 19.6%.

References

Qi, X., & Li, Y. (2024). LightCross: Sharding with Lightweight Cross-Shard Execution for Smart Contracts. Proceedings of the 42nd IEEE International Conference on Computer Communications (INFOCOM), 1681–1690.

Paper accepted by INFOCOM 2024 was originally published by Yi Li at Yi Li | Associate Professor | NTU on December 01, 2023.

Won ACM SIGSOFT Distinguished Paper Award at ASE'23

2023-09-14T00:00:00-00:00

Our paper, “EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software” [1], have won an ACM SIGSOFT Distinguished Paper Award at ASE’23. These were among the ten Distinguished Paper Awards selected from the 134 accepted papers (out of 629 submissions).

References

Zhang, Y., Xie, X., Li, Y., Chen, S., Zhang, C., & Li, X. (2023). EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software. Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), 686–697.

Won ACM SIGSOFT Distinguished Paper Award at ASE'23 was originally published by Yi Li at Yi Li | Associate Professor | NTU on September 14, 2023.

Paper accepted by FSE 2023 Ideas, Visions and Reflections Track

2023-07-19T00:00:00-00:00

A vision paper [1] tegother with Jacob Krüger, Chenguang Zhu, Marsha Chechik, Thorsten Berger, and Julia Rubin, is accepted at the FSE’23 Ideas, Visions and Reflections track. A summary of the paper is below:

Intentions are fundamental in software engineering, but are typically only implicitly considered through various related abstractions, such as requirements, use cases, features, or issues. Specifically, software engineers develop and evolve a software system based on such abstractions of a stakeholder’s intention—something a stakeholder wants the system to be able to do. Unfortunately, existing abstractions are (inherently) limited when it comes to representing stakeholder intentions and are used for documenting only. So, whether a change in a system fulfills its underlying intention (and only this one) is an essential problem in practice that motivates many research areas (e.g., testing to ensure intended behavior, untangling intentions in commits). We argue that none of the existing abstractions is ideal for capturing intentions and controlling software evolution, which is why intentions are often vague and must be recovered, untangled, or understood in retrospect. In this paper, we reflect on the role of intentions in software engineering and sketch how improving their management may support developers. Particularly, per we argue that continuously managing and controlling intentions as well as their fulfillment has the potential to improve the reasoning about what stakeholder requests have been addressed, avoid misunderstandings, and prevent expensive retrospective analyses. To guide future research for achieving such benefits for researchers and practitioners, we discuss the relations of different abstractions to intentions and propose steps towards managing intentions.

References

Krüger, J., Li, Y., Zhu, C., Chechik, M., Berger, T., & Rubin, J. (2023). A Vision on Intentions in Software Engineering. Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), 2117–2121.

Paper accepted by FSE 2023 Ideas, Visions and Reflections Track was originally published by Yi Li at Yi Li | Associate Professor | NTU on July 19, 2023.

Papers accepted by ASE 2023

2023-07-18T00:00:00-00:00

We have a technical paper [1] and a tool demonstration paper [2] accepted at ASE’23. The technical paper presents a practical method for detecting no-termination bugs in real-world software systems. While loop termination has been studied for many years, existing methods have limited scalability and are only effective on small programs. Our technique, EndWatch, is shown more effective than the state-of-the-art tools on standard benchmarks (detecting 87% of non-terminating programs while the best baseline detects only 67%), and useful in detecting non-termination in real-world projects (detecting 90% of known non-termination CVEs and 4 unknown bugs). In the second paper, we introduce a new dataset, CompSuite, which includes 123 real-world incompatibility issues. CompSuite is made available online and a video demostration can be found below.

CompSuite Demo Video

This year, 103 out of 629 submissions were accepted (another 31 were conditionally accepted) at ASE, which gives an acceptance rate of 21%.

References

Zhang, Y., Xie, X., Li, Y., Chen, S., Zhang, C., & Li, X. (2023). EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software. Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), 686–697.
Xu, X., Zhu, C., & Li, Y. (2023). CompSuite: A Dataset of Java Library Upgrade Incompatibility Issues. Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2098–2101.

Papers accepted by ASE 2023 was originally published by Yi Li at Yi Li | Associate Professor | NTU on July 18, 2023.

Paper accepted by ICDCS 2023

2023-04-10T00:00:00-00:00

Our paper [1] in collaboration with Xiaodong Qi and Jiao Jiao was accepted at ICDCS. A quick summary of the paper is given below.

As various optimizations being proposed recently, the performance of blockchains is no longer limited by the consensus protocols, successfully scaling to thousands of transactions per second. To further improve blockchains’ throughput, exploiting the parallelism in smart contract executions becomes a clear solution to resolve the new performance bottleneck. The existing techniques perform concurrency control on smart contract transactions based on pre-determined read/write sets, which can hardly be calculated precisely. As a result, many parallelization opportunities are missed in order to maintain the correctness of transaction executions. In this paper, we propose a novel execution scheduling framework, DMVCC, to further increase the parallelism in smart contract executions, via more fine-grained control on state accesses. DMVCC improves over existing techniques with two key features: (1) write versioning, eliminating the write-write conflicts between transactions, and (2) early-write visibility, enabling other transactions to read the writes from a transaction earlier, before it being committed. We integrated DMVCC into the Ethereum Virtual Machine, to evaluate its performance in real-world blockchain environments. The experimental results show that DMVCC doubles the parallel speedup achievable to a 20× overall speedup, compared with the serial execution baseline, approaching the theoretical optimum.

This year, 83 out of 439 submissions were accepted at ICDCS, which gives an acceptance rate of 18.9%.

References

Qi, X., Jiao, J., & Li, Y. (2023). Smart Contract Parallel Execution with Fine-Grained State Accesses. Proceedings of the 43rd IEEE International Conference on Distributed Computing Systems (ICDCS), 841–852.

Paper accepted by ICDCS 2023 was originally published by Yi Li at Yi Li | Associate Professor | NTU on April 10, 2023.

Paper accepted by ICSE 2023

2022-12-11T00:00:00-00:00

Our paper [1] in collaboration with Sahar Badihi, Khaled Ahmed, and Julia Rubin was accepted at ICSE. A quick summary of the paper is given below.

Numerous program slicing approaches aim at helping developers troubleshoot regression failures – one of the most time-consuming development tasks. The main idea behind these approaches is to identify a subset of interdependent program statements relevant to the failure, minimizing the amount of code developers need to inspect. Accuracy and reduction rate achieved by these techniques are key considerations toward their applicability in practice: inspecting only the statements identified in the slice should be faster and more efficient than inspecting the code in full. This paper reports on our experiment applying one of the most recent and accurate slicing approaches, dual slicing, to the task of troubleshooting regression failures in eight large, open-source software projects. The results of our experiments show that slices produced in this setup are still very large to be comfortably managed. Moreover, we observe that most statements in the slice deal with propagation of information between changed code blocks; these statements are essential for obtaining the necessary context for the changes but are not responsible for the failure directly. Motivated by this insight, we propose a novel approach, implemented in a tool named ConSumSlice, for reducing the size of a slice by accurately identifying and summarizing the propagation-related code blocks. Our evaluation of ConSumSlice shows that it is able to produce slices that are 75% shorter than the original ones for our case-study projects (299 vs. 2,449 code-level statements, on average), thus, reducing the amount of information developers need to inspect without losing the necessary contextual information. We believe our study and the proposed approach will help promote the efficient integration of slicing-based techniques in debugging activities and will inspire further research in this area.

This year, 209 out of 796 submissions were accepted at ICSE, and 35 of them were conditionally accepted, which gives an acceptance rate of 26%.

References

Badihi, S., Ahmed, K., Li, Y., & Rubin, J. (2023). Responsibility in Context: On Applicability of Slicing in Semantic Regression Analysis. Proceedings of the 45th International Conference on Software Engineering (ICSE), 563–575.

Paper accepted by ICSE 2023 was originally published by Yi Li at Yi Li | Associate Professor | NTU on December 11, 2022.

Paper accepted by ACM Transactions on Software Engineering and Methodology

2022-11-26T00:00:00-00:00

Our paper [1] in collaboration with Chenguang Zhu, Mengshi Zhang, Xiuheng Wu, and Xiufeng Xu was accepted by TOSEM. A quick summary of the paper is given below.

Modern software systems are complex and they heavily rely on external libraries developed by different teams and organizations. Such systems suffer from higher instability due to incompatibility issues caused by library upgrades. In this paper, we address the problem by investigating the impact of a library upgrade on the behaviors of its clients. We developed CompCheck, an automated upgrade compatibility checking framework which generates incompatibility-revealing tests based on previous examples. CompCheck first establishes an offline knowledge base of incompatibility issues by mining from open source projects and their upgrades. It then discovers incompatibilities for a specific client project, by searching for similar library usages in the knowledge base and generating tests to reveal the problems. We evaluated CompCheck on 202 call sites of 35 open-source projects and the results show that CompCheck successfully revealed incompatibility issues on 76 call sites, 72.7% and 94.9% more than two existing techniques, confirming CompCheck’s applicability and effectiveness.

References

Zhu, C., Zhang, M., Wu, X., Xu, X., & Li, Y. (2023). Client-Specific Upgrade Compatibility Checking via Knowledge-Guided Discovery. ACM Transactions on Software Engineering and Methodology, 32(4), 1–31.

Paper accepted by ACM Transactions on Software Engineering and Methodology was originally published by Yi Li at Yi Li | Associate Professor | NTU on November 26, 2022.

Papers accepted by ASE 2022

2022-09-15T00:00:00-00:00

Two papers were recently accepted at ASE’22. The first one [1] is on the detection of API documentation errors in Solidity smart contract libraries. This is a joint work with my former research assistant, Chenguang Zhu, as well as my PhD students, Ye Liu and Xiuheng Wu. The second one [2] is an empirical study on the third-party library dependencies in the C/C++ Ecosystem.

This year, 78 out of 527 submissions (4 desk rejected) were accepted at ASE, and 38 submissions were conditionally accepted, which gives an acceptance rate of 22%.

References

Zhu, C., Liu, Y., Wu, X., & Li, Y. (2022). Identifying Solidity Smart Contract API Documentation Errors. Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering (ASE), 1–13.
Tang, W., Xu, Z., Liu, C., Wu, J., Yang, S., Li, Y., Luo, P., & Liu, Y. (2022). Towards Understanding Third-Party Library Dependency in C/C++ Ecosystem. Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering (ASE), 1–12.

Papers accepted by ASE 2022 was originally published by Yi Li at Yi Li | Associate Professor | NTU on September 15, 2022.

Paper accepted by FSE 2022 Demonstrations Track

2022-08-12T00:00:00-00:00

Most of the existing smart contract symbolic execution tools perform analysis on bytecode, which loses high-level semantic information presented in source code. This makes interactive analysis tasks—such as visualization and debugging—extremely challenging, and significantly limits the tool usability.

With Shang-Wei Lin, Palina Tolmach, and Ye Liu, we present SolSEE, a source-level symbolic execution engine for Solidity smart contracts. We describe the design of SolSEE, highlight its key features, and demonstrate its usages through a Web-based user interface. SolSEE demonstrates advantages over other existing source-level analysis tools in the advanced Solidity language features it supports and analysis flexibility.

A paper [1] describing SolSEE is accepted at the FSE’22 Demonstration track. You can find the video demonstration of the tool below.

SolSEE Demo Video

References

Lin, S.-W., Tolmach, P., Liu, Y., & Li, Y. (2022). SolSEE: A Source-Level Symbolic Execution Engine for Solidity. Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), 1687–1691.

Paper accepted by FSE 2022 Demonstrations Track was originally published by Yi Li at Yi Li | Associate Professor | NTU on August 12, 2022.