SEMA: Self-Evolving Multi-Agent Auditing for Smart Contracts

Smart contract auditing remains challenging because vulnerabilities often emerge only under complex execution conditions, cross-transaction interactions, and environment-dependent assumptions. Existing analysis techniques, including static analysis, symbolic execution, fuzzing, and recent LLM-assisted approaches, each provide useful but incomplete coverage, and monolithic auditing pipelines often struggle to balance search breadth, reproducibility, and reporting reliability. This paper presents SEMA, a self-evolving multi-agent auditing framework for smart contracts that formulates auditing as a resource-bounded discovery of concrete counterexamples under replay-certified reporting semantics. SEMA combines heterogeneous specialized agents, an orchestrator, a shared artifact-centric knowledge base, and a replay-based referee. During auditing, agents generate and consume reusable artifacts, such as candidate invariants, refuted hypotheses, transaction templates, and coverage cues, allowing the shared search state to evolve across rounds without modifying the analyzers themselves. To ensure reporting reliability, findings are accepted only when the referee can replay the candidate scenario under a pinned execution configuration and confirm violation of an executable security property. We further evaluate SEMA on an annotated smart contract benchmark under a fixed 300 s budget per contract. The full system achieves 0.9469 instance recall, 0.9441 success rate, and 0.9445 macro-average category recall on the retained executable subset, outperforming both symbolic-only and fuzzing-only baselines, as well as multi-agent ablations that disable dynamic knowledge evolution or cross-agent artifact reuse.