A Smart Contract Vulnerability Detection Model Based on Syntactic and Semantic Fusion Learning

Abstract

As a trusted decentralized application, smart contracts manage a large number of digital assets on the blockchain. Vulnerability detection of smart contracts is an important part of ensuring the security of digital assets. At present, many researchers extract features of smart contract source code for vulnerability detection based on deep learning methods. However, the current research mainly focuses on the single representation form of the source code, which cannot fully obtain the rich semantic and structural information contained in the source code, so it is not conducive to the detection of various and complex smart contract vulnerabilities. Aiming at this problem, this paper proposes a vulnerability detection model based on the fusion of syntax and semantic features. The syntactic and semantic representation of the source code is obtained from the abstract syntax tree and control flow graph of the smart contract through TextCNN and Graph Neural Network. The syntactic and semantic features are fused, and the fused features are used to detect vulnerabilities. Experiments show that the detection accuracy and recall rate of this model have been improved on the detection tasks of five types of vulnerabilities, with an average precision of 96% and a recall rate of 90%, which can effectively identify smart contract vulnerabilities.

An interpretable ensemble model framework for real-time anomaly detection and prediction of Ethereum blockchain transactions

“…Smart contract source code analysis through semantic and syntactic methods has been carried out by [36] using a data set (5,000 smart contracts) produced from a study [37]. This source code analysis involves several combinations of techniques, such as control flow graph (CFG), vectorization, and feature extraction (TextCNN).…”

A Survey of Vulnerability Detection Techniques by Smart Contract Tools

“…Thus, understanding Solidity concepts help to design secured and economical SCs. Hence, our research does not restrict vulnerability to unsecured access to Ether transfer statements (i.e., unprotected Ether withdrawal [15]), costly gas patterns [16], deprecated instructions (useful to identify vulnerabilities in old deployed SCs [17]), mathematical discrepancies [18], misusing SC's program variables [19] and Blockchain variables [20], resulting in miners' violations. But, we include any other coding flaw as minor as ignoring return values or devastating like reentrancy if it highlights a wicked intent.…”