LLM-generated DeFi workflows fail safety tests despite structural validity
Researchers have exposed a critical gap in LLM-driven DeFi automation: structurally sound workflows can still execute unsafe trades that violate user intent. DeFiFlowBench, a 207-prompt benchmark, reveals that standard prompting techniques (direct, constrained, few-shot) consistently produce unsafe configurations, with slippage bounds failing to protect against price impact. The team proposes Koan-Safe, a hybrid system combining intent parsing, modular generation, and structural repair with default safety guardrails, achieving 0.67 safety scores on held-out tests. This work signals a broader challenge for AI agents handling financial transactions: correctness of workflow structure does not guarantee safety of execution, forcing the field to rethink how LLMs should validate high-stakes decisions before deployment.
Modelwire context
ExplainerThe paper's core finding is that LLMs can generate syntactically valid DeFi transactions that still violate user intent through unsafe parameter choices (slippage, price impact). This is distinct from hallucination or logical errors; the workflows execute as written but do the wrong thing.
This connects directly to the crash-severity certification work from earlier this week. Both papers tackle the same deployment problem: a model can be locally accurate yet globally unsafe when shipped to production. The crash-severity paper wraps existing classifiers with distribution-free guarantees; DeFiFlowBench proposes intent parsing plus structural repair as the wrapper. The key parallel is that neither trusts the base model's outputs in isolation. Where crash-severity focuses on domain shift, DeFiFlowBench identifies a deeper issue specific to financial automation: even on-distribution prompts can produce parameter configurations that are technically valid but financially dangerous. This suggests a broader pattern in safety-critical AI where correctness of the artifact (query, transaction, prediction) differs from correctness of the outcome.
If Koan-Safe's 0.67 safety score holds when tested on real EVM transactions from live protocols (Uniswap, Aave, Curve) rather than synthetic benchmarks, the approach has real deployment potential. If it drops below 0.55 on mainnet data, the gap between benchmark and production will signal that the threat model is incomplete.
Coverage we drew on
This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.
MentionsDeFiFlowBench · Koan-Safe · EVM
Modelwire Editorial
This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.
Modelwire summarizes, we don’t republish. arXiv cs.LG originally reported this story as “DeFiFlowBench: Benchmarking and Improving Safe Executability in Natural-Language DeFi Workflow Synthesis”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.