The report
KASS, a smart-contract security research framework published on July 17, moves beyond vulnerability detection by generating and executing proof-of-concept exploits.
The paper's workflow retrieves relevant audit findings, builds an attack plan, generates a Foundry test and uses execution feedback to repair code or replan the strategy. The authors report successful exploit generation for 98 of 104 SmartBugs-Curated contracts and validation of nine of 11 CVE-tagged contracts.
diagram
KASS exploit-synthesis loop
- Audit knowledge
Retrieved real-world audit findings
- Attack planner
Builds an explicit exploit strategy
- PoC generator
Produces a Foundry test
- Foundry execution
Checks the state-changing exploit
- Repair or replan
Fix code-level errors or revise assumptions
- Audit knowledge Attack planner: retrieval
- Attack planner PoC generator: strategy
- PoC generator Foundry execution: execute
- Foundry execution Repair or replan: failure feedback
- Repair or replan PoC generator: inner repair
- Repair or replan Attack planner: outer replan
The headline number needs a boundary. This is controlled security research, not evidence that the same success rate applies to arbitrary deployed contracts. The paper also distinguishes its reproduced Claude Code comparison from previously reported numbers for systems whose implementations were not evaluated under the same protocol.
For defenders, the useful development is methodological: a finding can now be linked to an executable state-change test and a structured attack plan. That gives exploitability a stronger proof standard than a detector label alone.