Zero-shot LLM Solidity matches ground-truth behaviour in 20 to 26 per cent of cases. The measurement covers isolated functions, not deployed systems.
Aladdin Battikh||7 min read
Compiling is not the bar.
A model that emits Solidity which compiles has cleared the cheapest check in the pipeline. Salzano and colleagues benchmarked four models against 500 real-world Solidity functions and reported that 20 to 26 per cent of zero-shot generations behaved identically to the ground-truth implementation under test.1 The same generations scored high on semantic similarity to the originals. The code read like the real thing and did something else.
The paper names a mechanism rather than a general weakness. Generated contracts were consistently simpler than the originals, carrying lower cognitive and cyclomatic complexity and lower gas consumption, and the authors attribute this to omitted validation logic.1 Simplicity is the tell. A contract that costs less gas than the reference implementation has usually stopped checking something.
The failures do not sit at one layer.
Circle and OpenZeppelin, publishing ChainBench in 2026, separate the problem into reliably producing buildable and integrated code, then closing the last-mile invariants that make a contract safe.2 That separation matters because the two failures need different things to hurt you. A build failure needs nothing at all, because the compiler reports it before anything reaches a chain. An invariant failure needs a reader with capital, patience, and an incentive, and on a public chain that reader is guaranteed to arrive eventually.
Severity therefore tracks survivability, not frequency. The frequent failures are the harmless ones.
| STUDY AND DATE | POPULATION MEASURED | RESULT | LIMIT STATED BY THE AUTHORS |
|---|---|---|---|
| Salzano et al., Nov 20251 | 500 real-world Solidity functions, four models | 20 to 26 per cent of zero-shot generations behaved identically to ground truth under test | Function-level tasks, not whole systems |
| ChainBench, Circle and OpenZeppelin, 20262 | Multichain generation and translation tasks across model and agent harnesses | Aptos Move and Sui Move scored below NEAR Rust on the same task set | The authors state it does not certify security, correctness, or production readiness |
| EVMbench, OpenAI and Paradigm, 18 Feb 20263 | 117 curated vulnerabilities drawn from 40 audits | GPT-5.3-Codex scored 72.2 per cent in exploit mode against 31.9 per cent for GPT-5 | OpenAI states the benchmark does not represent the full difficulty of real-world contract security |
THREE PUBLISHED BENCHMARKS, WITH THE BOUNDARY EACH SET ON ITSELF. Every result above is measured on curated or function-scale tasks, which is the same limit the authors name.
Move is a low-resource language for a model.
Solidity, Vyper and Move lack the documentation volume, library depth and community corpus of Python or JavaScript, which leaves their representation inside a model more concentrated and produces higher rates of syntax error and incomplete logic.4 ChainBench observed the consequence directly. Aptos Move and Sui Move scored below NEAR Rust on comparable tasks, which the authors attribute to Rust appearing more often in general software development and therefore in pre-training data.2 Open-weight models on Sui Move, Aptos Move and Cairo frequently failed before semantic testing began, on type errors, missing modules, wrong function signatures, and a mistaken model of the target chain's object and module system.2
The obvious reply is that Move's type system compensates. Linear resource types enforce must-move semantics, so tokens cannot be duplicated or silently dropped, and the compiler rejects a class of error that Solidity leaves to the test suite.5 That reply is correct on its own terms and points the wrong way. Moving safety into the type system means the compiler rejects more, so a model weak on that type system fails earlier and more visibly. What survives compilation is the residue: authorisation, ordering, and economic assumptions, none of which the linear type system was ever checking. The build passing is a weaker signal in Move than in Solidity, not a stronger one.
Agents break contracts better than they write them.
EVMbench scored GPT-5.3-Codex at 72.2 per cent in exploit mode against 31.9 per cent for GPT-5, and reported weaker performance on detect and patch, with agents in detect mode sometimes halting after a single finding rather than auditing exhaustively, and patch mode struggling to remove a vulnerability while preserving intended behaviour.3 Read in order, the capability ranking runs exploit, then detect, then patch, and generation sits below all three because no benchmark grades it against an adversary at all.
The awkward part of that figure belongs here rather than in a footnote. OpenZeppelin reviewed the EVMbench dataset and reported methodological flaws and invalid vulnerability classifications, including at least four issues labelled high severity that are not exploitable in practice.6 The 72.2 per cent is therefore an upper bound on a dataset with known labelling errors, published 12 days after the benchmark itself. Anyone quoting the number without that qualification is quoting a headline.
No published benchmark settles the question for Move.
The existing work measures function-level generation, curated vulnerability sets, or translation tasks, and each paper says so.123 A test that would actually settle whether a model can write a Move module fit to hold value needs five properties, and current benchmarks hold two or three of them at a time.
| REQUIREMENT | WHY IT DECIDES THE QUESTION | WHICH PUBLISHED WORK HOLDS IT |
|---|---|---|
| Invariants written before generation, by someone other than the generator | Removes the risk that the model is graded against its own reading of the specification | Partially, in EVMbench patch mode3 |
| Module-scale tasks with cross-module calls and stored state | Function-level correctness does not compose, and the exploits live at the joins | None of the three above |
| Tasks published after the model's training cut-off, or held out | Distinguishes recall from reasoning on a low-resource language | Not stated in Salzano et al. or ChainBench |
| Build failure graded separately from semantic failure | The two carry different severity and different fixes | Yes, in ChainBench2 |
| Released code, data and harness, so a third party can rerun it | A number nobody can reproduce is an adjective | Yes, in EVMbench3 |
FIVE PROPERTIES A CONCLUSIVE MOVE BENCHMARK NEEDS. The third row is the one that voids most published results, because a model that saw the reference implementation during training is being tested on memory.
The saving is real and it moves rather than disappears.
Drafting with a model compresses the hours spent producing a first module. Those hours reappear in review, and they reappear at a higher rate, because reviewing unfamiliar code that looks correct is slower per line than writing it. Retrieval-augmented generation improved functional correctness by up to 45 per cent in Salzano's setup, which changes the size of the review burden and not its existence.1 The position that follows is narrow. Use the model to draft, scaffold and translate, and treat every line as unreviewed until an independent test says otherwise.
The trigger that would reverse that position is a benchmark holding all five rows of the table above, on Move, with released code. As of 29 Aug 2026 there is none to point at.
| NOT COVERED | WHY NOT, AND WHAT WOULD CHANGE IT |
|---|---|
| Any Bits & Blocks replication of these results | Planned, not started. No internal run exists and no number here is ours. The trigger is a fixed Move task set with invariants written before generation, at which point results publish with the commit hash of the harness. |
| Model names and versions beyond those the cited papers tested | The papers fix their own model sets and dates. Naming a current model would require a run we have not done. |
| Sui Move against Aptos Move | ChainBench reports both below NEAR Rust but the published breakdown does not support a ranking between them.2 A per-language task-level release would change this. |
| Formal verification as a mitigation | The Move Prover and similar tools change the argument, and assessing them requires running them on generated modules rather than citing their existence. Out of scope until that run exists. |
| Closed-source and agent-harness combinations | Harness choice measurably affects results,2 so any claim here would need the harness named alongside the model. |
| Whether these findings hold for audited production contracts | Every benchmark cited draws on competition or curated code. OpenAI notes that heavily deployed contracts undergo more scrutiny and may be harder to exploit.3 |
SALZANO, SCALABRINO, OLIVETO AND PARESCHI, BEYOND CODE SIMILARITY. arxiv.org
CIRCLE AND OPENZEPPELIN, CHAINBENCH. circle.com
OPENAI AND PARADIGM, INTRODUCING EVMBENCH. openai.com
GUIDING LLM-BASED SMART CONTRACT GENERATION WITH FINITE STATE MACHINE. arxiv.org
SMART CONTRACT LANGUAGES, A COMPARATIVE ANALYSIS. arxiv.org
OPENZEPPELIN, WE AUDITED OPENAI'S EVMBENCH. openzeppelin.com