PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement

arXiv:2604.06975 · cs.CR · Submitted 2026-04-08 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia, and with me are Elias and Priya, guest researcher.

Elias: Today's paper: "PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement".

Nadia: PSR2 proposes a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning to detect atomicity violations in smart contracts,

Elias: First, who's behind it and why it matters.

Title and authors: Nadia: So, we're diving into the paper PSR2 which proposes a framework for detecting atomicity violations in smart contracts using a combination of structural path searching and semantic reasoning. Elias, what do you make of this title and who are the authors we're looking at?

Elias: The title itself suggests a phased approach to reasoning, moving from structural analysis to something more context-aware through semantic extraction. We see Xiaoqi Li, Xin Wang, Wenkai Li, and Zongwei Li as the team behind this work. They seem to have tackled the core issue of atomicity violations in complex contract logic.

Priya: From a privacy and measurement standpoint, I'm curious about what kind of "atomicity violation" they are focusing on here; is it related to data leakage or just incorrect state transitions?

Nadia: That’s a fair question, Priya; we need to understand the specific vulnerability type because that dictates how much risk we're actually looking at when we think about exploitation. Elias, can you break down what this framework is actually trying to achieve in plain terms?

Elias: Basically, PSR2 aims to stop traditional static analyzers from producing too many false alarms or missing real issues by fusing graph-based evidence with deterministic semantic facts. They propose a three-stage process: first, the Semantic Context Analysis Module parses the code into facts; second, the Graph Structure Analysis Module searches for hazardous paths; and finally, they use a Fusion Decision Module to cross-validate those findings.

Priya: So, it's about building a comprehensive picture where you have both the flow of execution and the actual meaning of what’s happening inside the contract. That sounds like a way to get past just looking at code structure alone.

Nadia: Exactly; that context awareness is what makes it different from older tools that rely purely on pattern matching. Elias, can you elaborate on those three modules for us? I want to make sure we grasp the technical meat of the PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement.

Elias: Certainly; the first module is the Semantic Context Analysis Module, or SCAM, which parses the contract into a deterministic semantic repository, F. This involves profiling functions and state variables to figure out their roles and access patterns, along with extracting interaction dependencies by analyzing external calls to build a dependency set D that shows which state variables dictate those calls.

Title and authors: Priya: That sounds like they are trying to map out the data flow precisely so they know exactly which pieces of information are being moved between operations. Does this mean they can track a specific piece of data through multiple steps?

Elias: Precisely; the dependency set D helps them determine if a call is actually dependent on a specific state variable, which is crucial for checking atomicity. The second module, GSAM, takes the Control Flow Graph and maps nodes to operations like SLOAD or CALL to find "Dependent State Paths," flagging sequences where an external call interrupts a read-write sequence on a critical variable.

Nadia: And then the third part of this process involves synthesizing those structural alerts with the semantic facts to decide if we have a genuine issue. How does that final module, the Fusion Decision Module, actually make its call?

Elias: The Fusion Decision Module performs a cross-validation by querying SCAM facts for each suspicious path to create a semantic context annotation. It then uses a deterministic decision function based on whether the state variable is involved in the dependency and if the call happens strictly between the read and write operations, which determines if we flag it as high, medium, or low risk.

Priya: So it’s not just flagging any sequence of operations that looks suspicious; it’s confirming that a specific data dependency exists *and* that the call occurs in a precise spot relative to those dependencies. That level of specificity is what makes the results meaningful for us.

Nadia: It really does; and when we look at the experimental results, it's pretty compelling because decoupling those modules shows how much noise you get without them working together. The paper demonstrates that this fusion significantly reduces false positives, achieving a ninety-four point six nine percent F1-score in complex ERC-seven hundred twenty-one scenarios compared to tools like Semgrep, which scored only fifty-one point eight six percent.

Elias: That comparison really highlights the benefit of integrating the structural search with the semantic reasoning as detailed in PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement. It shows that fusing graph analysis with context-aware extraction effectively resolves the trade-off between false positives and false negatives that plagues traditional tools.

Title and authors: Priya: I think the implication here is that for critical applications, especially those dealing with complex assets like NFTs, relying on a tool that can handle this level of contextual nuance makes a real difference in security assurance. It suggests we move beyond just checking syntax to understanding the intended logic flow.

Nadia: Absolutely; and looking at the limitations they mention—which I assume are standard for any framework—the paper notes that the method is still constrained by the deterministic nature of its semantic repository F; if the initial parsing into F isn't perfectly accurate, everything downstream can be skewed.

Elias: That’s a fair point; the reproducibility hinges on how accurately SCAM builds that semantic context from the AST. The authors acknowledge that their framework is built around this specific model, and they state it doesn't necessarily handle every possible form of contract logic variation perfectly without further refinement of the semantic facts.

Priya: So, while it handles a lot of cases well, we still have to be mindful that the quality of the input—the semantic repository—is what ultimately limits how robust the output can be for those truly edge cases.

Nadia: That’s a realistic assessment; and overall, this paper is proposing a way to systematically handle atomicity violations by formalizing them into a unified model and then using that model to guide the structural analysis. We're going to wrap up this discussion on PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement.

Elias: It’s an interesting approach because it treats atomicity inconsistency not just as a sequence of events, but as a violation of defined semantic constraints, which is what the Unified Atomicity Inconsistency Model aims to capture.

Priya: I think the real impact will be in how developers build these systems; they'll have a clearer blueprint for identifying where their logic might be brittle concerning state consistency during external interactions.

Nadia: That’s the direction we’re heading with this research; understanding exactly where that read-write sequence is supposed to stay protected from an untimely call is key to building safer decentralized applications.

The paper's summary: Nadia: So, what this means for us on air is that we're looking at a system that doesn't just scan lines of code; it understands the actual meaning behind those lines to spot when a contract breaks its own rules about state consistency during complex operations.

Elias: Exactly, Nadia, and from my perspective as someone who deals with cryptography, this suggests they are trying to find violations based on formal proofs rather than just pattern matching against known bugs.

Priya: From a privacy standpoint, I’m interested in the data flow aspect; how does this framework actually capture the movement of sensitive information that causes these atomicity issues?

Nadia: That’s a big question, Priya; essentially, they build a map of every variable and every call to see exactly which pieces of data dictate what happens next within the contract.

Elias: And that's where the semantic context analysis module comes in, extracting formal descriptors for variables and precisely identifying dependencies between external calls and those state variables.

Priya: So you’re saying they’re creating a formal language for "what information can influence what action," which sounds like it could give us a much clearer picture of potential data leakage paths.

Nadia: Right, Priya, because when you have that level of semantic grounding, the structural analysis module can then look at the control flow graph and flag paths where an external call might disrupt a critical read-write sequence.

Elias: I’m also seeing that their fusion decision module isn't just randomly flagging paths; it uses those semantic facts to decide if the detected structural risk actually corresponds to a violation of the contract's intended logic.

Priya: That cross-validation sounds promising because it suggests they’re filtering out structural noise by verifying every suspicious path against real data dependencies.

Nadia: It’s that filtering mechanism that really gets my attention, because if you can reduce those false alarms so effectively, it means developers can actually trust the tool when it does flag something.

Elias: I'm also checking the assumptions here; they rely heavily on building a deterministic semantic repository F, and if that initial parsing step isn't perfect, then every subsequent finding could be based on shaky ground.

Priya: That’s a fair caveat; the authors admit that the accuracy of their input facts determines how robust their output will be for those tricky edge cases in contract logic.

Nadia: Well, what I’m seeing is that they’ve managed to significantly outperform pattern matching tools in complex scenarios, which is something we need to discuss more on air.

Elias: Indeed, the experimental results show a massive jump in accuracy when you look at intricate ERC-seven hundred twenty-one environments compared to older methods.

Priya: So the real impact here seems to be moving security analysis toward a model that understands both the shape of the execution and the underlying data integrity constraints simultaneously.

Nadia: It really is, and I want to talk about how this level of context-aware analysis could change how we approach securing decentralized applications.

The paper's improvements: Nadia: So, we’re looking at how the authors suggest they can take this framework further to make it even more robust against those tricky contract exploits we’ve been discussing.

Elias: They propose refining the fusion decision module by making that deterministic decision function even more nuanced based on the interaction dependency set.

Priya: Can you tell us what that means in practice for someone trying to audit a smart contract? Does it give auditors a clearer roadmap for where they should focus their attention?

Nadia: It means the system can assign risk levels with much finer granularity, distinguishing between different types of state inconsistency violations based on the specific data flow involved.

Elias: That level of specificity helps us understand if the potential exploit involves a simple missing check or a more complex sequence where an external call subtly changes a variable's role.

Priya: From my research area, I think that detailed output is crucial because it moves us beyond just knowing *that* something is risky to understanding *why* it’s risky in terms of the actual data being manipulated.

Nadia: Exactly, Priya; it gives us actionable intelligence instead of just a binary pass or fail result when we’re trying to assess the real-world risk involved.

Elias: I'm also seeing that they suggest an iterative refinement process where the semantic repository is updated not just once, but potentially after certain structural anomalies are identified.

Priya: That sounds like a feedback loop; it means the system learns from its mistakes during the analysis rather than just operating on a static snapshot of facts.

Nadia: That iterative learning capability could make the framework much more adaptable to different styles of contract writing, which is something we definitely need to discuss for real-world application.

Elias: I’m also checking the assumptions again; this iterative improvement relies on the initial semantic parsing being sound enough to capture the necessary context for those updates.

Priya: So, while it sounds like a powerful self-correcting mechanism, we still have to be mindful that its effectiveness is tied directly to how well that initial context is established.

Nadia: And that’s where the next part of our discussion comes in—we need to talk about how this all fits into the broader landscape of security tooling and what it means for the future of smart contract auditing.

Conclusion: Tom: So, we're wrapping up our discussion on PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement by summarizing what this framework actually accomplished and where it leaves us next in security research.

Nadia: Basically, we’ve seen how this framework takes the abstract problem of contract atomicity and grounds it in concrete semantic facts to find real vulnerabilities that traditional pattern matching misses.

Elias: I think the core contribution is successfully fusing graph-based structural searching with deterministic semantic reasoning to create a cross-validated system for finding these violations.

Priya: From a measurement standpoint, what this shows us is that context matters immensely; the data we get isn't just a list of code errors, but a structured map of how data moves through an application's logic.

Nadia: Right, Priya, and that structured map is exactly what allows us to assess the actual exploitability of these issues by understanding the specific state variables involved.

Elias: I’m still thinking about the assumptions; it really hinges on building that initial semantic repository accurately because if we misinterpret a variable's role in F, our entire structural search might be misdirected.

Priya: And that points to a key area for future work: developing more robust methods for generating those initial facts so the system can handle the messy realities of real-world contract code.

Nadia: Speaking of future work, I’m curious if this approach scales well to much larger contracts or more complex DeFi interactions where state management gets even trickier.

Elias: The authors hint that scaling will require further optimization of the fusion module, especially as the number of potential path combinations grows exponentially with contract size.

Priya: So, moving forward, we should be looking for AI systems that can leverage this kind of semantic reasoning to handle massive codebases while maintaining high accuracy in detecting these complex atomicity issues.

Nadia: That’s where we’re headed; it seems like the direction is toward frameworks that prioritize deep context over simple pattern matching when analyzing smart contracts.

Elias: I agree, and I think the real impact will be seeing this type of reasoning applied to more complex cryptographic protocols where state integrity is paramount.

Priya: It suggests a future where security analysis tools don't just look at syntax, but truly understand the intent and data flow behind that code.

Nadia: That’s a fantastic summary of the PSR2 framework and its path forward, so we’ll leave you with this deep dive into PSR2: A Phase-based Semantic Reasoning Framework for Atomicity Violation Detection via Contract Refinement.

Elias: We hope this discussion on the authors' work gives listeners a solid foundation for understanding how structural analysis and semantic context can work together to find real logic flaws.

Priya: I’m excited to see how these ideas translate into practical tools that help developers build safer decentralized applications in the years to come.

Hainan University

cs.CR

Submitted: 2026-04-08

Updated: 2026-10-01

Comments: Accepted to the Ideas, Visions, and Reflections (IVR) track at FSE 2026

DOI: 10.1145/3803437.3805575

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 86/100

The gist: PSR2 proposes a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning to detect atomicity violations in smart contracts,

Key concepts

Semantic Context Analysis Module (SCAM)
This module parses contract source code to build a 'semantic repository' of deterministic facts. It profiles functions and variables by determining their logical roles (e.g., price, update) and tracking how external calls depend on specific state variables, establishing the logical ground truth for the analysis.
Graph Structure Analysis Module (GSAM)
The GSAM converts the contract's control flow into a simplified graph where nodes represent critical operations like reading or writing state. It searches this graph for 'Dependent State Paths'—sequences where a read operation on a variable is interrupted by an external call, which is the structural definition of an atomicity violation.
Fusion Decision Module (FDM)
The FDM acts as the final gatekeeper, merging structural alerts from GSAM with semantic facts from SCAM. It uses these combined pieces of information to assign a risk level (High, Medium, or Low) to potential violations, ensuring that only paths confirmed by both structure and meaning are flagged as actual vulnerabilities.

Terminology

Summary

PSR2 proposes a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning to detect atomicity violations in smart contracts, addressing limitations in traditional tools by fusing graph-based evidence with semantic facts.

The gist

PSR2 is a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning to detect atomicity violations via contract refinement.

How it works

PSR2 operates through three primary stages: (1) Semantic Context Analysis Module (SCAM), which parses the source code into a deterministic semantic repository F, and (2) Graph Structure Analysis Module (GSAM), which searches the Control Flow Graph (CFG) for hazardous paths, and finally, the Fusion Decision Module (FDM), which cross-validates these findings.

Semantic Context Analysis Module (SCAM)

This stage establishes the logical ground truth by parsing the contract into an Abstract Syntax Tree (AST) to extract deterministic semantic facts, defined as F = (F, V, E). This involves:

  1. Function and State Profiling (F, V): Deriving formal descriptors for every function and state variable to categorize logical roles and access patterns. For instance, a variable's role is categorized by matching signatures against a keyword set Σ = price, update... and its access pattern (read, write, RW) is determined via AST traversal.

  2. Interaction Dependency Extraction (E): Analyzing every external call site to generate critical fact tuples Te = (loc, type, tgt, D). Crucially, SCAM performs data flow analysis to construct the dependency set D ⊆ V [10, 33], which identifies specifically which state variables dictate the call’s parameters or execution conditions.

Graph Structure Analysis Module (GSAM)

The GSAM transforms the contract’s CFG into a simplified graph G = (N', E') using a labeling function α: N → T, where nodes are mapped to critical atomicity-related operations such as SLOAD(s), SSTORE(s), CALL(t), CHECK, and OTHER. The module then identifies Dependent State Paths that contain both read and write operations on a critical variable s. A violation is flagged if an external call interrupts the read write sequence, defined by the atomicity safety predicate:

phiatomic (P, s) ⇐⇒ ∃i,m, j ∈ [1, k]: (i < m < j) ∧ (alpha (n i) = SLOAD(s)) ∧ (alpha (n m) = CALL(t)) ∧ (alpha (n j) = SSTORE(s)). The output is a repository of structurally risky paths: Ograph = (R, P, s, Seq).

Fusion Decision Module (FDM)

Operating as the logical gatekeeper, the FDM synthesizes structural alerts from GSAM and semantic facts from SCAM. For each suspicious path report Rj involving state variable s, it constructs a semantic context annotation Cj,s = (tgt, dep, interm) by querying SCAM facts:

** tgt:**

The call target type retrieved from facts Te.

** dep:**

A Boolean flag indicating if s is in Te.D (verifying data dependency).

** interm:**

A Boolean flag indicating if the call occurs strictly between SLOAD(s) and SSTORE(s) (verifying intermediate state inconsistency).

The FDM executes a deterministic decision function F to assign risk levels:

F(Pj, s), Cj,s =



(High, Dj,s) if dep ∧ interm ∧ tgt ≠ fixed

(Medium, Dj,s) if dep ∧ interm ∧ tgt = fixed

(Low, ∅) otherwise

A vulnerability is confirmed only when structural reachability is cross-validated by semantic dependencies. The final output is the Ofusion = Ø j,s F(Pj, s), Cj,s.

Experimental Results and Contributions

Experimental results on 1,600 contract samples demonstrate that PSR2 significantly outperforms patternmatching baselines. In complex ERC-721 scenarios, PSR2 achieved an F1-score of 94.69%, compared to 51.86% for existing tools like Semgrep. Ablation studies confirm the necessity of fusion: decoupling the modules results in PSRC2 SCAM exhibiting extreme over reporting (FPR = 88.81%) and PSRC2 GSAM generating structural noise (FPR = 11.27%). The Fusion Decision Module effectively prunes this noise, reducing the false-positive rate to 6.

Improvements for AI systems

Here are the specific improvements that can be made to existing AI systems, based on the PSR2 framework described in the paper, and what those improved systems could achieve:

The core improvement lies in shifting from rigid, signature-based or purely pattern-matching static analysis tools to a synergistic framework that combines structural reachability with deep semantic context.

Here are the specific enhancements and capabilities:

Abstract

With the rapid advancement of decentralized applications, smart contract security faces severe challenges, particularly regarding atomicity violations in complex logic such as Oracle and NFT contracts. Rigid rule sets often limit traditional static analyzers and lack deep contextual awareness, leading to high false-positive and false-negative rates when identifying vulnerabilities that depend on intermediate state inconsistencies. To address these limitations, this paper proposes PSR, a novel collaborative static analysis framework that integrates structural path searching with deterministic semantic reasoning. PSR utilizes a Graph Structure Analysis Module (GSAM) to identify suspicious execution sequences in control flow graphs and a Semantic Context Analysis Module (SCAM) to extract data dependencies and state facts from abstract syntax trees. A Fusion Decision Module (FDM) then performs formal cross validation to confirm vulnerabilities based on a unified atomicity inconsistency model. Experimental results on 1,600 contract samples demonstrate that PSR significantly outperforms pattern-matching baselines, achieving an F1-score of 92.36% in complex ERC-721 scenarios compared to 51.86% for existing tools. Ablation studies further confirm that our fusion logic effectively reduces the false-positive rate by nearly half compared to single module analysis.

Sources

Related papers