Case · DiggingBeagle record
KASS is a July 2026 research framework that retrieves audit knowledge, plans an exploit, generates a Foundry proof of concept, executes it, and revises the strategy when the test fails.
Published research on authorized smart-contract exploit synthesis and simulation. It is not evidence of an in-the-wild theft.
KASS starts where many scanners stop. It takes a suspected smart-contract weakness and asks whether an executable transaction sequence can actually change state in a harmful way. The framework retrieves related audit findings, builds an attack plan, generates a Foundry proof of concept and runs the test. Failed code can be repaired inside the current strategy, while failed assumptions can trigger a broader replanning loop.
The paper reports 98 successful exploit generations across 104 SmartBugs-Curated contracts and nine validations across 11 CVE-tagged contracts. Those numbers are useful evidence of capability, but they are not a loss estimate and should not be treated as a direct ranking against every other system because some comparison numbers come from different protocols.
For DiggingBeagle, the important shift is methodological. Detection, exploit synthesis and measurable state change can now sit in one reproducible workflow. That is useful for defenders, but it also resembles the exploit-development loops appearing in real threat-actor reporting.
Relevant findings from prior audits are retrieved for planning.
Boundary: finding / attack knowledge
The planner turns the target weakness into an explicit exploit strategy.
Boundary: knowledge / strategy
The generator emits a Foundry test constrained by the plan.
Boundary: strategy / executable test
Foundry execution provides feedback for code repair or strategy replanning.
Boundary: test / state change
The arXiv paper reports SmartBugs-Curated and CVE-tagged evaluations.
Locator: Abstract and real-world CVE evaluation
The paper reports successful validation of 9 of 11 CVE-tagged contracts.
Locator: Method overview
The paper describes planning, generation and testing with a hierarchical dual-loop refinement process.
Locator: Abstract and evaluation results
The paper reports a 94.23% success rate over 104 SmartBugs-Curated contracts.
Scope: Cross-system percentages should not be read as a clean vendor benchmark because the paper notes protocol and implementation differences.
Locator: Evaluation and limitations
The paper distinguishes its reproduced Claude Code baseline from comparisons to previously reported REX and AdvScanner results.
diagram
Retrieved real-world audit findings
Builds an explicit exploit strategy
Produces a Foundry test
Checks the state-changing exploit
Fix code-level errors or revise assumptions
chart
KASS paper. KASS and Claude Code were evaluated by the authors; the REX value is a previously reported result and is not a same-implementation head-to-head.
| Measure | percent of tested contracts |
|---|---|
| KASS GPT-5.1 | 94.23 |
| REX reported | 50 |
| Claude Code reproduced | 20.19 |
chart
KASS paper real-world CVE-tagged contract evaluation.
| Measure | CVE-tagged contracts |
|---|---|
| Validated | 9 |
| Not validated | 2 |
KASS makes exploitability a first-class research object. A future assessment can ask not only whether a detector flags a bug, but whether a controlled proof of concept reaches the claimed state change and under which assumptions.
DiggingBeagle. “KASS turned smart-contract findings into executable attack simulations.” First seen Jul 17, 2026. https://diggingbeagle.com/cases/kass-turned-smart-contract-findings-into-executable-attack-simulations/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.