Smart Contract Invariants Block All 28 Real Ethereum Exploits in INVARIANTEVAL, Validated Over 108,637 Replayed Transactions

arXiv 2608.13191·medium signalXBlueskyLinkedInCopy link

INVARIANTEVAL pairs 28 real Ethereum exploits with a human-authored invariant that blocks each attack, and PONDEREPLAY re-executes historical transactions to prove each invariant is both correct and sound rather than merely plausible. Replaying 108,637 historical transactions, the invariants block every attack in the benchmark. The second half of the experiment is the honest part for practitioners: the paper also measures whether state-of-the-art automated tools can actually discover these invariants, separating 'invariants work' from 'invariants can be found automatically'.