AI-FUZZ: Reinforcement Learning–Guided Stateful Fuzzing for Secure Smart Contracts

Rana Hassam Ahmed; Muhammad Zeeshan; Unais Ali; Muhammad Sarfraz Khan; Muhammad Danish Rasheed; Younus khan; Waleed khan; Majid Hussain

doi:10.29284/xk2csa29

Authors

Rana Hassam Ahmed Department of Computer Science, The University of Faisalabad, Faisalabad, 38000, Punjab, Pakistan
Muhammad Zeeshan Mathematics and Statistics Eastern Michigan University, USA.
Unais Ali Engineering Management Eastern Michigan University, USA
Muhammad Sarfraz Khan Computer Science Specialist Public Education Department MN, USA.
Muhammad Danish Rasheed Department of Information Technology, Berkeley City College, Berkeley, United States of America
Younus khan New Mexico Highlands University Department: Computer and information Science, Las Vegas, USA
Waleed khan College of dupage 425 Fawell Blvd, Glen Ellyn, IL 60137, United States
Majid Hussain

DOI:

https://doi.org/10.29284/xk2csa29

Keywords:

Smart Contract Security, Blockchain, Reinforcement Learning, Fuzz Testing, Vulnerability Detection,Ethereum, AI-based Testing, Gas Optimization, Stateful Fuzzing, Software Testing Framework

Abstract

Smart contracts power decentralised applications, but once deployed, their flaws stay exploitable. Existing fuzzers such as ConFuzzius, Smartian, and VULSEYE use hybrid static and dynamic analysis but depend on fixed heuristics and lack adaptive learning. AI-FUZZ is an adaptive machine learning guided fuzzing framework that pairs deep reinforcement learning with stateful graybox fuzzing. It learns from execution traces to improve input generation, focus on high-risk contract states, and cut redundant executions. The framework also includes static analysis, adaptive mutation, and an oracle-based validation to boost accuracy and reduce false positives. Tested on 42,738 real-world contracts, AI-FUZZ achieved a 96.8% true positive rate, 4.2% false positive rate, 27% higher detection coverage than leading fuzzers, and a 33% reduction in average detection time. It scales across small, medium, and large contracts and offers a self-improving, efficient, and reliable approach for large-scale blockchain security audits.

References

1. K. I. Gubbi, M. Tarighat, A. Sudarshan, I. Kaur, P. D. Kota, A. Sasan, and H. Homayoun, State of Hardware Fuzzing:

2. Current Methods and the Potential of Machine Learning and Large Language Models, in 2025 26th International Symposium on Quality Electronic Design (ISQED), pp. 1–7, 2025.

3. P. Qian, H. Wu, Z. Du, T. Vural, D. Rong, Z. Cao, L. Zhang, Y. Wang, J. Chen, and Q. He, Mufuzz: Sequence-aware

4. mutation and seed mask guidance for blockchain smart contract fuzzing, in 2024 IEEE 40th International Conference on Data Engineering (ICDE), pp. 1972–1985, 2024.

5. T. A. Shaikh, T. Rasool, K. Veningston, and S. M. Yaseen, The role of large language models in agriculture: harvesting

6. the future with LLM intelligence, Progress in Artificial Intelligence, vol. 14, no. 2, pp. 117–164, 2025.

7. C. Wu, J. Chen, Z. Wang, R. Liang, and R. Du, Semantic sleuth: Identifying ponzi contracts via large language

8. models, in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, pp. 582–593, 2024.

9. S.-I. Papadopoulos, C. Koutlis, S. Papadopoulos, and P. C. Petrantonakis, Verite: a robust benchmark for multimodal misinformation detection accounting for unimodal bias, International Journal of Multimedia Information Retrieval, vol. 13, no. 1, p. 4, 2024.

10. D. Wang, H. You, L. Zhu, K. Lin, Z. Chen, C. Yang, J. Yu, Z. Wang, and J. Chen, A Survey of Reinforcement Learning

11. for Software Engineering, arXiv preprint arXiv:2507.12483, 2025.

12. Y. Sun, D. Wu, Y. Xue, H. Liu, H. Wang, Z. Xu, X. Xie, and Y. Liu, Gptscan: Detecting logic vulnerabilities in smart contracts by combining gpt with program analysis, in Proceedings of the IEEE/ACM 46th International

13. Conference on Software Engineering, pp. 1–13, 2024.

14. S. Zerbini, S. Kharya, D. Boscovic, and E. Losiouk, Fuzzing for Smart Contract Interworking Security Evaluation: An Empirical Evaluation of the State of the Art, 2023.

15. C. Shou, J. Liu, D. Lu, and K. Sen, Llm4fuzz: Guided fuzzing of smart contracts with large language models, arXiv preprint arXiv:2401.11108, 2024.

16. R. Liang, J. Chen, C. Wu, K. He, Y. Wu, R. Cao, R. Du, Z. Zhao, and Y. Liu, Vulseye: Detect smart contract

17. vulnerabilities via stateful directed graybox fuzzing, IEEE Transactions on Information Forensics and Security, 2025.O. Zaazaa and H. El Bakkali, SmartLLMSentry: A Comprehensive LLM Based Smart Contract Vulnerability Detection

18. Framework, Journal of Metaverse, vol. 4, no. 2, pp. 126–137, 2024.

19. B. Wang, Y. Tong, S. Ji, H. Dong, X. Luo, and P. Zhang, A Review of Learning-based Smart Contract Vulnerability

20. Detection: A Perspective on Code Representation, ACM Transactions on Software Engineering and Methodology, 2025.

21. Y. Lin, F. Lin, G. Cai, H. Chen, L. Zou, Y. Liu, and P. Wu, Evolutionary reinforcement learning: A systematic review and future directions, Mathematics, vol. 13, no. 5, p. 833, 2025.

22. Z. Kong, C. Zhang, M. Xie, M. Hu, Y. Xue, Y. Liu, H. Wang, and Y. Liu, Smart Contract Fuzzing Towards Profitable Vulnerabilities, Proceedings of the ACM on Software Engineering, vol. 2, no. FSE, pp. 153–175, 2025.

23. J. Park and J. Choi, Towards Effective Guidance of Smart Contract Fuzz Testing Based on Static Analysis, Electronics, vol. 14, no. 4, p. 806, 2025.

24. B. Li, Z. Pan, and T. Hu, EvoFuzzer: An Evolutionary Fuzzer for Detecting Reentrancy Vulnerability in SmartContracts, IEEE Transactions on Network Science and Engineering, 2024.

25. J. J. de Leon, C. Zhang, C.-S. Koulouris, F. Medda, and R. Rahul, Smart Contract Security in Decentralized Finance:

26. Enhancing Vulnerability Detection with Reinforcement Learning, Applied Sciences, vol. 15, no. 11, p. 5924, 2025.

27. Z. He, Z. Li, S. Yang, H. Ye, A. Qiao, X. Zhang, X. Luo, and T. Chen, Large language models for blockchain security:

28. A systematic literature review, arXiv preprint arXiv:2403.14280, 2024.

29. D. Liu, J. Zhang, Y. Wang, H. Shen, Z. Zhang, T. Ye, Blockchain Smart Contract Security: Threats and Mitigation

30. Strategies in a Lifecycle Perspective, ACM Computing Surveys, 2025.

31. Y. Sun, D. Wu, Y. Xue, H. Liu, H. Wang, Z. Xu, X. Xie, and Y. Liu, When gpt meets program analysis: Towardss

32. intelligent detection of smart contract logic vulnerabilities in gptscan, arXiv preprint arXiv:2308.03314, 2023.

33. R. H. Ahmed, M. Hussain, and A. Khalil, Blockchain-Based Supply Chain Management in Healthcare, in AI and Blockchain Applications for Privacy and Security in Smart Medical Systems, pp. 107–132, 2025.

34. R. H. Ahmed, M. Hussain, A. Khalil, and S. Zahid, Strengthening Security in Pharmaceutical Healthcare: Harnessing Blockchain for Reliable Detection of Counterfeit Drugs and Mitigating Dispensing Errors, in 2025 16th InternationalConference on Information and Communication Systems (ICICS), pp. 1–6, 2025.

35. C. Shou, J. Liu, D. Lu, and K. Sen, Llm4fuzz: Guided fuzzing of smart contracts with large language models, arXiv preprint arXiv:2401.11108, 2024.

36. B. Amangeldy, T. Imankulov, N. Tasmurzayev, G. Dikhanbayeva, and Y. Nurakhov, A Review of Artificial

37. Intelligence and Deep Learning Approaches for Resource Management in Smart Buildings, Buildings, vol. 15, no. 15, p. 2631, 2025.

38. R. H. Ahmed, J. Sultana, S. Zahid, M. A. Habib, A. Rauf, and M. Hussain, Integrating Large Language Models and AI into Blockchain: A Framework for Intelligent Smart Contracts and Fraud Detection, IEEE Access, pp. 1–1, 2025, doi: 10.1109/ACCESS.2025.3622511.