Source-linked AI summary
Smart Contract Vulnerability Detection: From Pure Neural Network to Interpretable Graph Feature and Expert Pattern Fusion
Zhenguang Liu, Peng Qian, Xiang Wang, Lei Zhu, Qinming He, Shouling Ji
TL;DR
Smart-contract vulnerability detection must handle fixed expert rules and encode expert knowledge while remaining interpretable. The paper automatically extracts vulnerability-specific patterns, derives deep features from semantic graphs, and fuses them with an attentive multi-encoder network. Across evaluated vulnerabilities, the method outperforms existing approaches and provides feature-weight explanations and warnings for highly weighted patterns.
Problem
Smart contracts control substantial digital assets, while conventional detectors rely on fixed expert rules and deep learning methods fail to encode useful expert knowledge.
Method
The method automatically extracts vulnerability-specific expert patterns, derives graph features from code semantics, and interpretably fuses local patterns with global graph features.
Results
The method significantly outperforms existing approaches, with accuracy improving from 84% to 90%, 83% to 87%, and 75% to 80% across three vulnerability types.
Takeaways & Limitations
The model provides fine-grained prediction explanations through feature weights, warnings for highly weighted local patterns, and a broader view of feature significance.
Abstract
from arXiv · showhide
Smart contracts hold digital coins worth billions of dollars, their security issues have drawn extensive attention in the past years. Towards smart contract vulnerability detection, conventional methods heavily rely on fixed expert rules, leading to low accuracy and poor scalability. Recent deep learning approaches alleviate this issue but fail to encode useful expert knowledge. In this paper, we explore combining deep learning with expert patterns in an explainable fashion. Specifically, we develop automatic tools to extract expert patterns from the source code. We then cast the code into a semantic graph to extract deep graph features. Thereafter, the global graph feature and local expert patterns are fused to cooperate and approach the final prediction, while yielding their interpretable weights. Experiments are conducted on all available smart contracts with source code in two platforms, Ethereum and VNT Chain. Empirically, our system significantly outperforms state-of-the-art methods. Our code is released.
1 Introduction
Smart contracts manage substantial digital assets but are difficult to secure because their code is immutable and existing detection methods rely on limited fixed patterns. The paper combines automatically extracted expert patterns with semantic graph features in an interpretable network and reports improved vulnerability-detection accuracy.
- Motivation: More than 10 billion dollars in digital currency is controlled by deployed smart contracts, making them attractive targets for attackers.The DAO reentrancy exploit alone stole Ether worth 60 million dollars.
- Motivation: Immutable deployment requires developers to anticipate all future code states and environments, while immature languages and tools leave room for misunderstandings.
- Existing methods: Conventional detection methods rely on fixed expert rules that can be error-prone, miss complex patterns, and be bypassed by small attacker modifications.
- Proposed approach: The proposed system automatically extracts vulnerability-specific expert patterns, builds a semantic graph for deep graph features, and fuses both through an attentive multi-encoder network.The network produces interpretable weights for the combined features.
- Results: Accuracy improves from 84% to 90%, 83% to 87%, and 75% to 80% across three vulnerability types on 40k contracts from two benchmark datasets.
- Contributions: The work emphasizes interpretable fusion of expert patterns and deep graph features and releases its implementation for future research.
2 Problem
The paper formulates smart-contract vulnerability detection as fine-grained, function-level prediction that simultaneously identifies a vulnerability label and explains the prediction through feature weights. It focuses on reentrancy, block-timestamp dependence, and infinite-loop vulnerabilities.
- Task formulation: The task predicts whether a smart-contract function is vulnerable or safe while outputting feature weights that explain the label.
- Target vulnerabilities: Reentrancy allows a recipient callback to invoke a transfer function again before the first transfer updates the balance.An attacker can therefore obtain more Ether than their balance permits.
- Target vulnerabilities: Block-timestamp dependence arises when a function uses a miner-influenced block timestamp in a condition governing a critical operation.
- Target vulnerabilities: An infinite loop unintentionally iterates forever, causing execution to run out of gas while consuming the fee without completing the intended operation.
3 Method
The method combines automatically extracted vulnerability-specific expert patterns with a graph representation of code semantics. A TMP graph network extracts global graph features, and an attentive multi-encoder fuses them with local pattern features while producing interpretable weights.
- Local Expert Pattern Extraction: The system extracts vulnerability-specific expert patterns automatically, including checks for reentrancy, timestamp dependence, and infinite loops.Patterns are implemented through source-code scanning, keyword matching, and taint analysis for complex data-flow patterns.
- Graph Construction and Normalization: The code is represented as a semantic graph containing core nodes, normal nodes, and an additional fallback node.Core nodes capture vulnerability-relevant invocations and variables, while normal nodes provide auxiliary information.
- Attentive Multi-Encoder Network: An attentive multi-encoder fuses local pattern features with the global graph feature to predict vulnerability labels and output feature weights.Self-attention and cross-attention support fusion, and inner products with the final semantic vector provide interpretable weights.
- Graph Construction and Normalization: Graph normalization removes normal nodes and merges their features into nearby core nodes before graph-neural-network processing.This addresses differences among code graphs and the unequal importance of nodes during information propagation.
- Feature Extraction: Multiple MLPs encode local expert patterns, while a temporal-message-propagation graph neural network extracts a global graph feature.The graph network propagates information along code-order edges and aggregates node states into the global feature.
4 Experiments
Experiments evaluate AME on Ethereum and VNT Chain datasets against conventional tools and neural methods, while examining interpretability and component effects. AME achieves strong detection performance, its feature weights provide interpretive insight, and removing either graph features or expert patterns reduces performance.
- Experimental setup: Experiments use ESC and VSC datasets, with reentrancy and timestamp dependence evaluated on ESC and infinite-loop detection on VSC.ESC contains 307,396 functions from 40,932 Ethereum contracts; VSC contains 13,761 functions from 4,170 VNT Chain contracts.
- Comparison with conventional detection tools: 90.19% accuracy: AME improves reentrancy detection by 13.07% over the state-of-the-art tool.Securify and Slither achieve 71.89% and 77.12% accuracy, respectively.
- Comparison with conventional detection tools: 12.32% accuracy improvement: AME surpasses the state-of-the-art tool on timestamp dependence and leads on all four metrics.Slither achieves 74.20% accuracy, while the authors attribute conventional tools’ weakness to checking timestamp usage without assessing its effect on critical operations.
- Comparison with conventional detection tools: AME consistently outperforms the compared methods on infinite-loop vulnerability detection by a large margin.The comparison includes Jolt, SMT, PDA, and Looper.
- Comparison with deep learning methods: Graph neural network models outperform sequential models, while AME exceeds GCN, DR-GCN, and TMP across three vulnerabilities.The results support representing source code as a graph and indicate that encoding expert patterns contributes to performance gains.
- Interpretability evaluation: The global graph feature generally receives the greatest weight, while local expert patterns retain considerable weights and support vulnerability-specific interpretation.For reentrancy, callValueInvocation and balanceDeduction rank highly; timestampAssign and timestampContaminate do so for timestamp dependence.
- Effects of removing expert patterns and graph features: Removing either graph features or expert patterns lowers performance, with graph-feature removal causing the larger drop.AME remains better than both ablations across epochs and vulnerabilities.
5 Related Work
Early smart-contract vulnerability detection used formal verification, symbolic analysis, and dynamic execution to reason about contract behavior.
- Formal-method approaches translate Solidity and EVM bytecode into verification-system inputs or reason about EVM models with Isabelle/HOL.The cited examples include a translation framework and an Isabelle/HOL-based formal model.
- Symbolic analysis and dynamic execution form another major stream of vulnerability-detection research.
6 Conclusion
The paper combines deep learning with automatically extracted expert patterns to make smart-contract vulnerability detection both accurate and explainable. Its system provides fine-grained explanations and weight distributions, and the experiments show strong performance against state-of-the-art approaches.
- The system combines neural networks with automatic expert-pattern extraction for explainable smart-contract vulnerability detection.
- The model produces fine-grained explanations and a broader view of feature-weight distributions.
- The experiments show that the method significantly outperforms state-of-the-art approaches.