Trace-Driven Automated PoC Synthesis for On-Chain Attacks

Abstract

Blockchain systems are increasingly targeted by on-chain attacks that exploit vulnerabilities in smart contracts, resulting in billions of dollars in losses. Understanding and reproducing these attacks is critical for defense, yet currently relies on manually crafting proofs-of-concept (PoCs), which is labor-intensive, expertise-driven, and difficult to scale. In this work, we take the first step toward automating PoC synthesis directly from transaction traces. Our key insight is that a concrete execution trace provides not only behavioral evidence for recovering exploit logic, but also runtime semantics that enable precise code synthesis and verification. We design TracExp, a trace-driven framework that combines a dual decompiler, which fuses symbolic lifting with concrete runtime values to produce semantically enriched pseudocode, and a sketch-based synthesis and refinement mechanism that grounds LLM generation in execution context and ensures semantic correctness. Evaluated on 321 real-world DeFi attacks collected over 20 months, TracExp achieves 94.70% generation, 83.80% compilable, and 57.01% verifiable rates, at an average cost of ∼$0.1 per case. Moreover, we contributed 33 previously unavailable PoCs within 2 days to DeFiHackLabs, and all were accepted and merged, earning $900 in bounties, demonstrating both the practical effectiveness and real-world impact.