SecureFlow: An LLM-Based Multi-Agent System for Automated Smart Contract Vulnerability Detection and Patching

Smart contracts govern substantial financial value on public blockchains; however, because deployed contract code is immutable, a vulnerability that survives review cannot be patched in place. Pre-deployment auditing is the main safeguard for contract security; in addition to providing a warning, it must identify the flaw, explain why it is exploitable, and supply a candidate correction. Static analyzers match fixed patterns and emit many false alarms, while a single large language model asked to detect, explain, and repair a flaw in one pass tends to degrade on each subtask. We introduce SecureFlow, a multi-agent framework in which three agents share a Qwen3-8B backbone: SecureProbe detects vulnerable contracts, SecureAnalyze classifies them under the DASP Top-10, and SecureSynthesize writes a root-cause explanation and a minimally invasive patch through in-context learning. Against seventeen open and proprietary models on the SmartBug and Smart Contract Vulnerability datasets, SecureFlow performs on par with the strongest baselines, including fine-tuned GPT-4o, reaching accuracy and weighted F1 of 0.93 and 0.96 on the two datasets, respectively, while running locally on 8B open weights. It completes reports for 93.33% and 85.15% of instances; in blinded manual review of 50 sampled completed reports per dataset, patch and explanation validity are respectively 0.94 and 0.96 on SmartBug and 0.88 and 0.90 on the second dataset. A controlled prompt study shows that adding the predicted label and a knowledge-base hint improves generation and validity for every model, making prompt design a primary factor for language model auditing. An end-to-end auditor can match proprietary baselines while explaining and repairing flaws.