Small Language Models for Smart Contract Vulnerability Detection: A Fine-Grained Analysis on Capabilities, Localization, and Failure Modes

Smart contracts secure high-value blockchain applications, yet vulnerabilities continue to cause severe financial losses, making automated detection critical. While large language models (LLMs) show strong potential for code and security analysis, their cost, deployment constraints, and reliance on proprietary services limit practical adoption. Small language models (SLMs) offer a lightweight alternative, but their capabilities for smart contract vulnerability detection remain poorly understood. Existing studies mainly assess vulnerability type prediction, leaving unclear whether SLMs can localize vulnerable code, control false positives (FPs), and fail in predictable ways. In this paper, we present a fine-grained empirical study of SLMs for smart contract vulnerability detection. We evaluate four representative SLMs on SmartBugs-Curated under a standardized zero-shot setting, covering contract-level detection, line-level localization, FP behavior, and failure analysis. We further compare SLMs with frontier LLMs and established analysis tools on real-world CVEs. Results show that SLMs are a promising foundation for lightweight smart contract auditing, with useful detection and localization capabilities, and can achieve competitive results against some advanced commercial tools. However, SLMs remain inconsistent on vulnerabilities that require deeper exploit reasoning, indicating the need for domain-aware reasoning and verification mechanisms.