PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation

Overview

• This paper explores using large language models (LLMs) like GPT-4 to automatically generate customized properties for unknown code based on existing human-written properties.
• The key challenges addressed are ensuring the generated properties are compilable, appropriate, and runtime-verifiable.
• The proposed system, called PropertyGPT, successfully generated high-quality properties, detected known vulnerabilities, and uncovered new zero-day vulnerabilities.

Plain English Explanation

Large language models (LLMs) like GPT-4 have become incredibly powerful at understanding and generating human-like text. This paper investigates whether we can leverage these models to help with the process of writing properties for code verification.

Properties are essentially rules or assertions about how a piece of code should behave. When you're working with complex, unfamiliar code, it can be challenging to come up with the right properties to check that the code is working correctly. The researchers wanted to see if an LLM could take examples of existing properties and use that knowledge to automatically generate new, customized properties for other code.

The key challenge is ensuring these automatically generated properties are actually useful - they need to be written in a way that the computer can understand and verify, and they need to accurately describe the intended behavior of the code. The researchers developed strategies to address these issues, such as using compiler feedback to refine the properties and designing a specialized prover to formally verify their correctness.

Overall, the researchers' system called PropertyGPT was able to generate high-quality properties that were effective at detecting known vulnerabilities and even uncovering new ones that had not been discovered before. This shows the potential for using powerful language models to assist with the critical task of verifying the security and correctness of complex software.

Technical Explanation

The core idea of this paper is to leverage the language understanding capabilities of large language models (LLMs) like GPT-4 to automatically generate customized properties for unknown code. The researchers start by embedding existing human-written properties (e.g., from Certora auditing reports) into a vector database.

When given a new piece of code, the system retrieves a reference property from the database and uses it as a starting point for LLM-based in-context learning to generate a new, tailored property. However, ensuring the generated properties are (i) compilable, (ii) appropriate, and (iii) runtime-verifiable presents several challenges.

To address (i), the researchers use the compilation and static analysis feedback as an external "oracle" to guide the LLM in iteratively revising the generated properties until they are compilable. For (ii), they consider multiple dimensions of similarity to rank the properties and employ a weighted algorithm to identify the top-K properties as the final result. For (iii), they design a dedicated prover to formally verify the correctness of the generated properties.

The researchers implemented these strategies into a system called PropertyGPT, which they evaluated using 623 human-written properties collected from 23 Certora projects. Their experiments showed that PropertyGPT can generate comprehensive and high-quality properties, achieving an 80% recall compared to the ground truth. It also successfully detected 26 out of 37 known CVEs/attack incidents and uncovered 12 zero-day vulnerabilities, resulting in $8,256 in bug bounty rewards.

Critical Analysis

The researchers have presented a compelling approach to leveraging the power of large language models to assist in the critical task of verifying the security and correctness of complex software. By automating the generation of properties, their system has the potential to significantly streamline the auditing process and uncover vulnerabilities that might otherwise be missed.

That said, the paper does acknowledge some limitations and areas for further research. For example, the researchers note that their approach currently relies on the availability of a substantial corpus of existing human-written properties, which may not always be the case. Additionally, while the prover they designed can formally verify the generated properties, it is unclear how scalable or efficient this process is for real-world, large-scale codebases.

Another potential concern is the potential for bias or inaccuracies in the properties generated by the LLM, even with the iterative refinement process. The researchers do not explore the extent to which the generated properties might diverge from the true intent of the code, and how such discrepancies could impact the effectiveness of the verification process.

Overall, the researchers have presented an intriguing and promising approach, but further work may be needed to address these potential limitations and ensure the reliability and scalability of the PropertyGPT system, especially as it is applied to increasingly complex and mission-critical software systems.

Conclusion

This paper explores the use of large language models (LLMs) like GPT-4 to automatically generate customized properties for unknown code, with the goal of streamlining the process of verifying the security and correctness of complex software. By embedding existing human-written properties into a vector database and using LLM-based in-context learning, the researchers' PropertyGPT system was able to generate high-quality properties that were effective at detecting known vulnerabilities and uncovering new zero-day issues.

While the paper acknowledges some limitations, such as the reliance on a corpus of existing properties and the scalability of the formal verification process, the researchers have demonstrated the significant potential of leveraging powerful language models to assist with the critical task of software auditing. As LLMs continue to advance, integrating them with structured knowledge bases and tailoring them for specific domains could lead to even more powerful and reliable tools for ensuring the safety and security of complex software systems.