KASS starts where many scanners stop. It takes a suspected smart-contract weakness and asks whether an executable transaction sequence can actually change state in a harmful way. The framework retrieves related audit findings, builds an attack plan, generates a Foundry proof of concept and runs the test. Failed code can be repaired inside the current…
Inspect the ClaimsCase · DiggingBeagle record
KASS turned smart-contract findings into executable attack simulations
KASS is a July 2026 research framework that retrieves audit knowledge, plans an exploit, generates a Foundry proof of concept, executes it, and revises the strategy when the test fails.
Scope
Published research on authorized smart-contract exploit synthesis and simulation. It is not evidence of an in-the-wild theft.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- WITH AI
Basis and provenance
The paper's authorized exploit-generation/simulation experiments are capability research. Benchmark and reproduction limitations remain explicit; remediation of a single exploited product is not applicable to this research-method Case. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CVE · CLM-LOOP · CLM-SMARTBUGS · CLM-COMPARISON · Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts
At a glance
KASS makes exploitability a first-class research object. A future assessment can ask not only whether a detector flags a bug, but whether a controlled proof of concept reaches the claimed state change and under which assumptions.
Read the implicationsIndependent reproduction outside the paper's authors is not established in the current source set. The paper's comparison with systems whose implementations were unavailable is not a same-protocol head-to-head benchmark.
Limits and uncertaintyFull account
KASS starts where many scanners stop. It takes a suspected smart-contract weakness and asks whether an executable transaction sequence can actually change state in a harmful way. The framework retrieves related audit findings, builds an attack plan, generates a Foundry proof of concept and runs the test. Failed code can be repaired inside the current strategy, while failed assumptions can trigger a broader replanning loop.
The paper reports 98 successful exploit generations across 104 SmartBugs-Curated contracts and nine validations across 11 CVE-tagged contracts. Those numbers are useful evidence of capability, but they are not a loss estimate and should not be treated as a direct ranking against every other system because some comparison numbers come from different protocols.
For DiggingBeagle, the important shift is methodological. Detection, exploit synthesis and measurable state change can now sit in one reproducible workflow. That is useful for defenders, but it also resembles the exploit-development loops appearing in real threat-actor reporting.
Mechanism and trust boundary
- 01
Retrieve analogous audit knowledge
Relevant findings from prior audits are retrieved for planning.
Boundary: finding / attack knowledge
- 02
Build an attack plan
The planner turns the target weakness into an explicit exploit strategy.
Boundary: knowledge / strategy
- 03
Generate an executable proof of concept
The generator emits a Foundry test constrained by the plan.
Boundary: strategy / executable test
- 04
Execute and repair
Foundry execution provides feedback for code repair or strategy replanning.
Boundary: test / state change
Timeline
- Jul 17, 2026Event type unspecified
KASS paper published
The arXiv paper reports SmartBugs-Curated and CVE-tagged evaluations.
Claims & evidence
CLM-CVEOn 11 real CVE-tagged smart contracts, the KASS paper reports validating nine exploit cases.supported
Basis: reported finding · active
Recorded measurement: 9 validated CVE-tagged contracts · KASS evaluation on 11 CVE-tagged contracts
- supportsBeyond Detection: Agentic Attack Synthesis and Simulation for Smart Contractsprimary
Abstract and real-world CVE evaluation
CLM-LOOPKASS separates attack planning, proof-of-concept generation and execution testing, then uses inner repair and outer replanning loops when generated exploits fail.supported
Basis: reported finding · active
- supportsBeyond Detection: Agentic Attack Synthesis and Simulation for Smart Contractsprimary
Method overview
CLM-SMARTBUGSThe KASS paper reports executable exploit generation for 98 of 104 SmartBugs-Curated contracts, an overall rate of 94.23%.supported
Basis: reported finding · active
Recorded measurement: 94.23 percent of tested contracts · KASS evaluation on 104 SmartBugs-Curated contracts
- supportsBeyond Detection: Agentic Attack Synthesis and Simulation for Smart Contractsprimary
Abstract and evaluation results
CLM-COMPARISONThe paper reports KASS outperforming a reproduced Claude Code baseline under the same protocol, while comparisons with REX and AdvScanner rely on previously reported results rather than a shared implementation.supported
Basis: reported finding · active
Scope: Cross-system percentages should not be read as a clean vendor benchmark because the paper notes protocol and implementation differences.
- supportsBeyond Detection: Agentic Attack Synthesis and Simulation for Smart Contractsprimary
Evaluation and limitations
Evidence visuals
diagram
KASS exploit-synthesis loop
- Audit knowledge
Retrieved real-world audit findings
- Attack planner
Builds an explicit exploit strategy
- PoC generator
Produces a Foundry test
- Foundry execution
Checks the state-changing exploit
- Repair or replan
Fix code-level errors or revise assumptions
- Audit knowledge Attack planner: retrieval
- Attack planner PoC generator: strategy
- PoC generator Foundry execution: execute
- Foundry execution Repair or replan: failure feedback
- Repair or replan PoC generator: inner repair
- Repair or replan Attack planner: outer replan
chart
KASS SmartBugs-Curated exploit-generation results
KASS paper. KASS and Claude Code were evaluated by the authors; the REX value is a previously reported result and is not a same-implementation head-to-head.
| Measure | percent of tested contracts |
|---|---|
| KASS GPT-5.1 | 94.23 |
| REX reported | 50 |
| Claude Code reproduced | 20.19 |
chart
KASS validation on real CVE-tagged contracts
KASS paper real-world CVE-tagged contract evaluation.
| Measure | CVE-tagged contracts |
|---|---|
| Validated | 9 |
| Not validated | 2 |
Implications
KASS makes exploitability a first-class research object. A future assessment can ask not only whether a detector flags a bug, but whether a controlled proof of concept reaches the claimed state change and under which assumptions.
Controls and mitigations
- Keep exploit execution inside disposable, forked or otherwise controlled environments.
- Preserve the exact contract version, chain state and test harness for reproducibility.
- Separate detector accuracy from exploit-generation success when comparing tools.
Unknowns and contradictions
- Independent reproduction outside the paper's authors is not established in the current source set.
- The paper's comparison with systems whose implementations were unavailable is not a same-protocol head-to-head benchmark.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 2
- Sep 25, 2026 · Published version · material revision · revision 38Public fields changed: assessment_profile
- Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: claims