Yizhou Chen

Automated Program Repair (APR) aims to automatically fix buggy programs. In recent years, with the rapid advancement of Large Language Models (LLMs), LLM-based APR techniques have achieved significant progress. Despite their potential, the effectiveness of LLMs relies heavily on the quality of the provided repair context. However, existing LLM-based APR approaches suffer from a causality gap when constructing such contexts. Specifically, on the test side, existing methods struggle with test context ambiguity arising from noise interference or dependency absence; meanwhile, on the source side, existing retrieval-augmented methods primarily rely on static analysis inevitably introduce static over-approximation, resulting in contexts filled with unexecuted code and noise. Consequently, these contexts mislead LLMs, hindering them from identifying the true root cause and leading to incorrect fixes. To bridge this gap, we introduce the concept of minimal causal context, defined as the essential set of dependencies required to explain a specific failure. Based on this, we propose CausalRepair, a novel conversation-driven APR framework that instantiates this concept through a synergistic dual-slicing strategy. Specifically, CausalRepair employs context-aware static slicing on the test side to purify test semantics, and utilizes execution-trace-based dynamic slicing on the source side to capture precise runtime dependencies. This constructs a high-quality context causally relevant to the bug, which filters out irrelevant code and guides the iterative repair process. We evaluate CausalRepair on the widely used Defects4J (V1.2 and V2.0) and the latest Defects4J-Trans benchmarks. To ensure a fair comparison, we unify the backbone model as DeepSeek-V3 in all experiments. The results demonstrate that CausalRepair correctly fixes 313 bugs on Defects4J, significantly outperforming state-of-the-art approaches such as ReinFix and TSAPR, while reducing the average repair cost to $0.029 per bug, achieving a dual optimization of effectiveness and efficiency.

Smart contracts have enabled decentralized financial applications, enabling trustless and transparent asset management. However, their programmability also expands the attack surface, allowing adversaries to encode fraudulent economic behaviors directly into contract logic. Among these threats, Smart Contract Ponzi Schemes (SCPS) represent a particularly harmful class of on-chain financial fraud, in which malicious developers mimic legitimate decentralized finance applications to extract unlawful value from users. Existing detection approaches using static analysis or deep learning often fail to capture SCPC-specific behaviors, while LLMs suffer from hallucinations and lack supervision. To address these limitations, we propose PonziLicle, a novel framework that enhances SCPC detection by systematically modeling the lifecycle behaviors of Ponzi schemes. Specifically, we analyze the typical life cycle of SCPCs and identify five behavioral perspectives that are closely tied to their structure: fund flow, profit logic, referral mechanism, withdrawal control, and camouflaged naming. For each perspective, we design tailored prompts and utilize LLMs to generate fine-grained, perspective-specific code explanations. To mitigate hallucinations, we employ static analysis to extract reliable, contract-level signals aligned with these perspectives, which are then used to calibrate and refine the LLM-generated explanations. Finally, we integrate the smart contract source code, static signals, and calibrated explanations to train a deep learning classifier for SCPC detection. Experimental results on 6,946 real-world smart contracts show that PonziLicle outperforms 7 state-of-the-art SCPC detection methods, achieving an F1-score of 0.958, with an increase of 10.26% to 122.31%.

Modern software development heavily relies on reusing third-party and internal Application Programming Interfaces (APIs). However, API misuses occur frequently, leading to program crashes, security vulnerabilities, and other unexpected behaviors. To detect API misuse, many existing approaches mine API usage patterns from code repositories or documentation and flag code that violates these patterns as potential misuses. Despite their usefulness, such pattern-based methods often lack a deep understanding of the actual calling context, and the mined patterns are typically tied to specific APIs, limiting their generalizability and ultimately constraining their effectiveness in detecting API misuse. In this paper, we address API misuse detection from a new perspective by directly analyzing API-level contextual information and reasoning over it. To this end, we propose LAMDA, the first agent-based API misuse detector. LAMDA incorporates five customized modules that leverage large language models and specialized tools to generate multi-dimensional insights about API-level contexts, and it employs an iterative discussion mechanism to identify misuses more accurately. We compare LAMDA with state-of-the-art approaches on a newly collected dataset. Experimental results show that LAMDA achieves 68.34% precision, 76.81% recall, and 72.31% F1-score, significantly outperforming all baselines.

Smart contracts have revolutionized the way transactions are executed, offering decentralized and immutable frameworks. The immutability of smart contracts poses significant risks when vulnerabilities exist in their code, leading to financial losses. Despite advancements in using deep learning for smart contract vulnerability detection (SCVD), existing methods struggle with the complex logic and intricate semantics embedded within smart contract code. Large Language Models (LLMs) have shown promise in providing deeper insights into smart contract logic. However, LLMs, such as GPT follow a decoder-only architecture and are trained in an unsupervised manner rather than learning specific labels. In the SCVD task, these LLMs have difficulty in capturing information related to vulnerabilities, leading to very low accuracy. Therefore, we propose CodeXplain, a novel SCVD approach that leverages the deep insights into code from LLM and the supervised learning capabilities of deep learning models to set the latest advance and performance. In particular, we deeply analyze 14 types of dangerous and common smart contract vulnerabilities. Based on the rationale of these vulnerabilities, nine perspective prompts are introduced to guide LLMs in generating code explanations that contribute to SCVD. Then, we propose a CodeT5-based semantic fusion module integrating smart contract code and code explanations. Finally, the performance of SCVD is improved by performing supervised learning on trusted labels. Experimental results on 3,544 real-world smart contracts demonstrate that CodeXplain outperforms 16 state-of-the-art SCVD methods, achieving an F1-score of 94.12% and an accuracy of 93.88%, surpassing all baselines.

The e X tensible M arkup L anguage (XML) is a file format widely used for data transmission in modern software development. In recent years, embedding SQL statements in XML files (i.e., XML-SQL) has become a popular way for developing applications with database access capability. Typically, XML-SQL code snippets demonstrate similar functionalities and structures, leading to repetitive programming work. Therefore, leveraging pre-trained code models for automated code generation presents a promising way to alleviate duplicated efforts and enhance the efficiency of developing XML-SQL code. However, XML-SQL code has strong domain-specific characteristics that general pre-trained code models typically struggle to fully harness, thereby leading to limited overall performance of general pre-trained code models. In this article, we aim to address the challenge of handling this domain-specific knowledge. First, we propose a code updating task and construct the corresponding TwinXSQL dataset to better evaluate the model’s code generation performance in the XML-SQL domain. Then, we leverage the common characteristics of XML-SQL and other programming languages (i.e., all programming languages impose grammar constraints on behavior) to design a bipartite-grammar–aware training framework (named BGA) for unsupervised pre-training, thereby improving the transfer of general-purpose code models to the XML-SQL domain. Specifically, we divide the XML-SQL code into two types of grammatical components: structure components and value components. During pre-training, we undertake three tasks, each designed to learn the internal information of these grammatical components and the relationships between them, enabling the pre-training process to better incorporate previously unlearned domain-specific knowledge of XML-SQL code. Our experimental results show that our trained model XSQLT5-base (220M) improves accuracy by 13.8% compared to the similarly sized CodeT5-base (220M). Additionally, our experiments reveal that ChatGPT, due to its inability to fully learn the XML-SQL domain knowledge, achieves a much lower generation accuracy even with few-shot samples compared to our XSQLT5-base (220M) model.

Deep neural networks (DNNs) are one of the most effective methods available for detecting smart contract vulner-abilities (SCVs). The performance of current DNN approaches relies heavily on a large number of training samples and labels. The semi-supervised learning (SSL) trains the pseudo-labeling mechanism and performs label propagation on unlabeled data, thereby mitigating this problem. However, these approaches are not suitable for tasks related to Smart Contract Vulnerability Detection (SCVD) due to their limitations in capturing subtle faults, which are the primary causes of SCVD. We believe that subtle faults are contained in the correlation feature, which encompasses both commonalities among vulnerable contracts and differences between vulnerable and non-vulnerable contracts. Therefore, we propose a correlation-driven SSL method called Jupiter to solve this limitation. Specifically, Jupiter incorporates a contrastive learning module that conducts pairwise comparisons between smart contracts and captures correlation features. These correlation features facilitate the separation of feature distributions in vulnerable and non-vulnerable contracts. Then, a support vector machine with a built-in RBF kernel function is utilized to establish a decision boundary between the two types of contract distributions. We employ the distance from data to the decision boundary as a confidence score and propagate high-quality pseudo-labels to each unlabeled data surpassing the threshold. This process is iterated, where the labeled dataset is constructed using a combination of pseudo-labeled and reallabeled data to be re-input into the contrastive learning model until all data is labeled. Finally, the combination of semantic information and correlation features accurately detects SCVs. By conducting an empirical evaluation on a large-scale realworld dataset comprising over 40,000 smart contracts, we compare the performance of 6 state-of-the-art SSL methods and 5 state-of-the-art SCVD methods. Our findings demonstrate the effectiveness of our proposed method, Jupiter, in two key aspects: (1) Jupiter achieves optimal performance across all SSL methods, outperforming them by 18.89% to 28.42% in terms of F1- score; (2) Current state-of-the-art SCVD methods fail to deliver satisfactory results when only small amounts of labeled data are available. Specifically, these methods achieve F1-scores ranging from 49.72% to 50.98% when utilizing just 10% of the labeled data. In contrast, under the same conditions, Jupiter outperforms all baselines, achieving an F1-score of 89.28%, which represents an improvement of 75.12% to 79.56%.

Modern software development often introduces bug inducing commits (BICs) that can degrade performance or cause crashes. Swift localization of BICs is crucial but challenging due to the entanglement among multiple kinds of information overlooked by existing methods that treat these elements independently. Understanding this entanglement is promising but faces two key challenges: (1) the entanglement representation problem, since simply concatenating diverse data types fails to capture their entanglement effectively; (2) the large input size problem, as identifying BICs requires analyzing a vast set of commits, making simultaneous processing infeasible. To address these challenges, we propose BICSleuth, a framework that encodes the entanglement for effective BIC localization through three stages. First, a small-model-based ranker efficiently narrows down commits despite large input sizes. Second, an LLM-based discriminator deepens the understanding of the entanglement through selective information integration. Third, a reranking strategy combines insights from both stages to enhance localization accuracy. Evaluated on a BIC dataset constructed from Defects4J v2.0.0, BICSleuth outperforms four state-of-the-art approaches, achieving 148.9% of the Mean Reciprocal Rank compared to the best spectrum-based baseline and 507.1% of the MRR of the best IR-based method. Additionally, BICSleuth ranks the BIC first in 70.0% of projects and within the top five in 84.6%. The results demonstrate that BICSleuth effectively leverages the entanglement for BIC localization, with all stages contributing to its success.