A 2026 study put 100 developers of varying experience in front of smart contracts with real, planted business-logic bugs. No reentrancy, no overflow, no missing modifier. Just logic a reviewer has to reason through: a reward calculation that uses the wrong balance, a price feed that trusts the wrong source, a collateral check that fires at the wrong moment. Working from source code alone, the developers found 12% of the bugs.1
Hand the same developers a visual map of the contract’s business-logic dependencies alongside pattern-flagged hints, and that number moves to 58.3%.1 Roughly a 4.9x improvement, on bugs where the code is correct and the mistake lives entirely in what the code was asked to do.
If you’re deciding how your team reviews business logic in 2026, that’s the real question: not which scanner to buy, but which of three different approaches to put in front of a human reviewer. The evidence now says something specific about each one.
Why this bug class resists the tools everyone already has
We’ve covered the split before: smart contract bugs come in two kinds. Implementation bugs live at the code level, reentrancy, overflow, access control, and static analyzers like Slither and Mythril are good at finding them. Logical bugs live at the specification level. The code runs exactly as written. The written logic is wrong. No pattern-matcher flags a reward formula that is internally consistent and economically broken.
This is a different failure mode from the alarm-fatigue problem we wrote about in July. That post was about too much noise: scanners throwing 40 to 90 findings per 1,000 lines, under 10% of them real. This is about too little signal: a bug class where the baseline detection rate, unaided, is 12%. One problem is drowning in false positives on bugs tools already catch. The other is a near-total blind spot on bugs tools structurally can’t catch without a human in the loop. A 2025 study on automated functional-bug detection, PROMFUZZ, puts a number on that blind spot directly: it found that over 80% of exploitable real-world DeFi bugs, most of them functional or business-logic bugs rather than syntactic ones, evaded the tools being tested against them.3
Three approaches, three numbers
The paper behind the 12%/58.3% figures, SmartGraphical, from Ali Fattahdizaji, Mohammad Pishdar, and Zarina Shukur, ran a controlled comparison across exactly the approaches most teams are actually choosing between right now.1
| Approach | Detection rate | Source |
|---|---|---|
| Unaided human review (source code only) | 12% | SmartGraphical 100-developer study |
| LLM review (ChatGPT-4o) | 43.6% | SmartGraphical standalone tool evaluation |
| LLM review (Gemini 1.5 Pro) | 44% | SmartGraphical standalone tool evaluation |
| Human-in-the-loop hybrid (pattern-driven static analysis + visual abstraction) | 58.3% | SmartGraphical 100-developer study |
| Human-in-the-loop hybrid, tool’s own evaluation condition | 85.7% average | SmartGraphical standalone tool evaluation |
| Fully automated, no human step (LogicScan, cross-protocol invariant mining) | 85.2% F1 | LogicScan |
Two things in that table need unpacking before you read them as a ranking.
First, LLMs do beat unaided humans here, 43.6% and 44% against a 12% floor, but they land well short of the hybrid number. That matters because an LLM pass is probably what a lot of teams are already running in place of a real logic review in 2026: paste the contract into Claude or GPT, ask “any issues here,” and treat a clean answer as a pass. The evidence says that pass catches fewer than half the planted logic bugs. A separate Feb-2024 paper corroborates this independently, from a different angle: scored against the SolidiFI benchmark for syntactic vulnerabilities, GPT-4 hit 96.6% precision but only 37.8% recall and a 41.1% F1-score, meaning it missed most real bugs rather than over-flagging. When the same paper checked GPT-4 against eight sets of professional audit reports for business-logic reasoning specifically, average accuracy fell to 12.8%.2 Two separate groups of researchers, two separate methodologies, and they agree on the same shape: LLMs are comparatively strong at syntactic pattern-matching and weak at business-logic reasoning specifically.
Second, the 58.3% and 85.7% hybrid numbers are not the same measurement and shouldn’t be read as one line. The 58.3% figure comes from the 100-developer study, real people using the tool under study conditions. The 85.7% figure comes from the paper’s own standalone evaluation of the tool’s heuristic-plus-visual pipeline against a labeled contract set, a different experimental setup entirely. Both numbers point the same direction, but citing them interchangeably overstates what either one proves on its own.
Worth naming for completeness: LogicScan, a fully automated approach we covered here, skips the human step entirely and instead mines the invariants mature deployed protocols already enforce, hitting 85.2% F1 on business-logic vulnerabilities with no reviewer in the loop at all. SmartGraphical and LogicScan are two different bets on the same gap: one augments a human, the other tries to remove the human. Neither is a shipped product yet.
What the hybrid tool actually does
SmartGraphical’s automated layer is a pattern-driven heuristic scanner tuned to eleven named categories of logical risk: external oracle dependencies, supply manipulation, collateral and debt logic, balance discrepancies, incentive alignment, price manipulation, complex calculations, non-deterministic calls, unrestricted public access, legacy signature mismatches, and naming ambiguities.1 On a standalone test set of 800 contracts (65 verified vulnerable, 735 not), that heuristic layer alone hit 91% sensitivity and 94.5% specificity.1
Those numbers look strong until you read the paper’s own conclusion: “Although the tool produced heuristic alerts in 82% of the cases, the findings clearly highlight the need for our Human-in-the-Loop (HITL) solution,” as authors Fattahdizaji, Pishdar, and Shukur put it directly.1 That’s not a footnote, it’s the design thesis. The visual layer isn’t a nice-to-have bolted onto a working automated detector. It exists because the automated detector by itself produces alerts at that volume, and the paper’s own authors say so plainly.
The visualization itself converts contract code into a directed graph: nodes represent components, edges represent functional and data dependencies, covering function-to-variable access, initialization order, systemic interactions, and control-flow complexity.1 That’s a deliberately different graph from the one in our earlier post on audit visualization, which covered Surya and Slither’s call-graph printers for topological bugs, cross-contract reachability, who can call what. That graph shows the shape of control. This one shows the shape of business logic: which state variables actually move together, and whether that movement matches what the protocol’s economics are supposed to do. The paper isn’t alone in betting on this pattern. A parallel 2026 ACM paper, CodeVoyager, pairs LLM reasoning with interactive call-graph and control-flow visualization for general code comprehension, not security specifically, which suggests the hybrid-visual approach is showing up as a trend across 2026 research, not a one-off.
What this means for a team right now
None of this is a product you can install today. SmartGraphical and LogicScan are both research, not tooling you point at a CI pipeline. But three things are actionable now regardless of whether either paper ever ships:
-
Don’t treat an LLM pass as a substitute for structured logic review. The evidence says a general-purpose LLM catches fewer than half the planted bugs in this exact category, and a separate benchmark found GPT-4’s accuracy against professional audit reports on business-logic reasoning averaged just 12.8%. It’s a useful first filter. It is not an audit of your business logic.
-
Build an explicit visual map of your business-logic dependencies before review, even a manual one. The gap between 12% and 58.3% isn’t really about the specific tool. It’s about giving a reviewer a structural map of how state variables relate instead of asking them to hold that relationship in their head while reading a 400-line contract top to bottom. You can draw that map on a whiteboard before you ever see a tool that automates it.
-
Treat this as a process decision, not a purchasing decision. Until SmartGraphical or something like it ships as a real product, the fix is procedural: pattern-match on where logic bugs cluster (reward accounting, collateral checks, oracle trust assumptions) and force a visual walkthrough of exactly those sections before sign-off.
The explorer connection
The principle underneath all of this isn’t specific to pre-deployment review. Giving a human a structural map instead of raw code to reason about is also why post-deployment tooling matters for the same bug class. A block explorer that decodes internal call trees, state diffs, and event logs at each step is doing the same job SmartGraphical does before launch, just applied to what a contract actually did in production instead of what it might do. Ethernal renders that execution context for any EVM-compatible chain, which is where a logic bug that survived review usually becomes visible first: not in the source, but in a trace where the numbers don’t add up. We’ve written about the mechanics here.
The three numbers worth remembering: 12% unaided, roughly 44% with a general-purpose LLM, 58.3% with a structured visual hybrid under study conditions. None of them are good enough to call this problem solved. But they’re specific enough to change how you spend review time this quarter.
References
1. Fattahdizaji, A., Pishdar, M., Shukur, Z. “SmartGraphical: A Human-in-the-Loop Framework for Detecting Smart Contract Logical Vulnerabilities via Pattern-Driven Static Analysis and Visual Abstraction.” arXiv, March 27, 2026 (v2). https://arxiv.org/abs/2603.08580
2. “Evaluation of ChatGPT’s Smart Contract Auditing Capabilities Based on Chain of Thought.” arXiv, February 2024. https://arxiv.org/abs/2402.12023
3. Lin, X., Xie, Q., Zhao, B., Tian, Y., Zonouz, S., Ruan, N., Li, J., Beyah, R., Ji, S. “PROMFUZZ: Leveraging LLM-Driven and Bug-Oriented Composite Analysis for Detecting Functional Bugs in Smart Contracts.” arXiv, March 2025. https://arxiv.org/abs/2503.23718
