SecChain: Operationalizing Security Guidelines for Multi-agent Smart Contract Generation

Abstract

Smart contracts generated by large language models (LLMs) can compile yet still violate basic security obligations, and existing generation frameworks largely treat security as post-hoc verification rather than as a constraint that persists throughout generation and repair. We present SecChain, a multi-agent smart-contract generation framework built around a persistent SecuritySpec artifact that makes requirement-level security obligations explicit and preserves them across planning, coding, testing, auditing, and fixing. Five LLM-powered agents collaborate with a fully deterministic Coordinator through stage-specific procedures, deterministic pre-test verification, and nested repair loops, while an Auditor provides complementary semantic review grounded in a three-layer security knowledge base. We evaluate SecChain on 1,000 contracts from the finite-state-machine-guided smart-contract generation (FSM-SCG) dataset against vanilla GPT-4o, GPT-5.4, Claude Sonnet 4.6, and the FSM-SCG framework. SecChain achieves an 89.0% final compilation rate and a Zero Risk Contract Proportion (ZRCP) of 60.3%, compared with 12.7% for vanilla GPT-4o and 23.3% for FSM-SCG. With a GPT-4o backbone, SecChain still outperforms the tested vanilla current-generation models (GPT-5.4, Claude Sonnet 4.6) on the primary security metrics.