Source-linked AI summary
Combining Graph Neural Networks with Expert Knowledge for Smart Contract Vulnerability Detection
Zhenguang Liu, Peng Qian, Xiaoyang Wang, Yuan Zhuang, Lin Qiu, Xun Wang
TL;DR
Smart-contract vulnerability detection remains important because exploited contracts can cause substantial financial losses, while prior neural-network work ignored expert patterns and key variables. This paper combines expert patterns with contract-graph semantics and reports improved F1 scores across three vulnerabilities on Ethereum and VNT Chain contracts.
Problem
Prior neural-network work used graph features while ignoring expert patterns and key variables, despite the financial losses caused by exploited smart contracts.
Method
The approach represents source-code control- and data-flow semantics as normalized contract graphs, extracts graph features with temporal message propagation, and combines them with expert patterns.
Results
F1 score improved from 78% to 86%, 79% to 88%, and 74% to 82% for reentrancy, timestamp dependence, and infinite loop vulnerabilities, respectively.
Takeaways & Limitations
The method sets new state-of-the-art performance for smart contract vulnerability detection and provides released implementations for future research.
Abstract
from arXiv · showhide
Smart contract vulnerability detection draws extensive attention in recent years due to the substantial losses caused by hacker attacks. Existing efforts for contract security analysis heavily rely on rigid rules defined by experts, which are labor-intensive and non-scalable. More importantly, expert-defined rules tend to be error-prone and suffer the inherent risk of being cheated by crafty attackers. Recent researches focus on the symbolic execution and formal analysis of smart contracts for vulnerability detection, yet to achieve a precise and scalable solution. Although several methods have been proposed to detect vulnerabilities in smart contracts, there is still a lack of effort that considers combining expert-defined security patterns with deep neural networks. In this paper, we explore using graph neural networks and expert knowledge for smart contract vulnerability detection. Specifically, we cast the rich control- and data- flow semantics of the source code into a contract graph. To highlight the critical nodes in the graph, we further design a node elimination phase to normalize the graph. Then, we propose a novel temporal message propagation network to extract the graph feature from the normalized graph, and combine the graph feature with designed expert patterns to yield a final detection system. Extensive experiments are conducted on all the smart contracts that have source code in Ethereum and VNT Chain platforms. Empirical results show significant accuracy improvements over the state-of-the-art methods on three types of vulnerabilities, where the detection accuracy of our method reaches 89.15%, 89.02%, and 83.21% for reentrancy, timestamp dependence, and infinite loop vulnerabilities, respectively.
1 INTRODUCTION
Smart contract vulnerabilities threaten substantial assets, while conventional expert-pattern detection is labor-intensive, error-prone, and vulnerable to bypasses. The paper combines normalized contract graphs, temporal graph learning, and expert patterns, improving F1 scores across three vulnerabilities.
- Security motivation: Smart contracts hold more than 10 billion dollars in virtual coins, and the DAO reentrancy exploit stole 3.6 million Ether worth 60 million US Dollars.
- Security motivation: Immutable deployment and immature languages and tools make smart-contract bugs difficult to anticipate and impossible to patch after deployment.
- Research gap: Conventional detection relies on manually defined expert patterns that can miss complex cases, produce false positives and negatives, and be bypassed by attackers.
- Approach: The method investigates more than 300,000 smart contract functions with automated function-level detection using contract graphs, node elimination, temporal message propagation, and expert patterns.
- Results: F1 score improves from 78% to 86%, 79% to 88%, and 74% to 82% for reentrancy, timestamp dependence, and infinite loop vulnerabilities, respectively.
- Contributions: The paper fuses conventional expert patterns with graph-neural-network features and introduces contract-graph normalization to highlight key variables and invocations.
2 RELATED WORK
Prior work spans formal verification, symbolic and dynamic analysis, and neural models for vulnerability detection. The paper positions its approach as a smart-contract-specific method that models semantic structure, critical variables, and temporal relationships.
- Formal and symbolic methods: Formal methods translate Solidity and EVM representations into verification systems or reason about EVM bugs using Isabelle/HOL.
- Formal and symbolic methods: Symbolic-execution and pattern-based tools such as Oyente, Maian, and Securify analyze contract behavior using compliance or violation patterns.
- Dynamic analysis: Dynamic methods including ContractFuzzer and Sereum monitor runtime behavior or data flows, but hand-crafted agent contracts prevent fully automated, scalable applications.
- Neural approaches: Deep-learning approaches process source-code sequences, contract graphs, or operation-code bigrams, yet the field remains young and reported accuracy unsatisfactory.
- Positioning: Unlike general program-analysis GNNs, this work targets smart-contract vulnerabilities while accounting for distinct program-element roles and temporal relationships.
3 PROBLEM STATEMENT
The paper formulates function-level vulnerability detection as binary classification and focuses on reentrancy, timestamp dependence, and infinite-loop vulnerabilities. It introduces fallback execution because fallback functions are central to contract invocation behavior and reentrancy.
- Problem formulation: Given smart-contract source code, the system estimates a binary label for each function, where 1 denotes a specific vulnerability and 0 denotes safety.
- Fallback mechanism: Function invocation follows a matching signature to the corresponding function; otherwise execution jumps to the fallback function, while money transfer triggers fallback execution.
- Vulnerability types: Reentrancy lets a recipient fallback function call back before the original transfer completes, exploiting the sender's intermediate state for repeated transfers.
- Vulnerability types: Timestamp dependence occurs when block timestamps trigger critical operations, while miners can set timestamps within a short interval of less than 900 seconds.
- Vulnerability types: An infinite loop has no exit condition or an unreachable exit condition, including for loops, while loops, and self-invocation loops.
- Scope rationale: The three vulnerabilities were selected because real attacks caused more than 100 million USD in losses and they may affect many contracts.
4 OUR METHOD
The method extracts vulnerability-specific expert patterns and converts smart-contract source code into normalized temporal contract graphs. A temporal message propagation network combines graph features with pattern features for vulnerability detection.
- Method overview: The architecture has three phases: expert-pattern extraction, contract-graph construction and normalization, and vulnerability detection using fused pattern and graph features.The final detection network combines the pattern feature Pr and graph feature Gr to produce the detection result.
- Expert Pattern Extraction: The method defines vulnerability-specific expert patterns for reentrancy, timestamp dependence, and infinite-loop vulnerabilities, supported by an open-sourced extraction tool.Simple patterns use keyword matching, while other patterns use syntax or taint analysis.
- Reentrancy: For reentrancy, the patterns inspect call.value invocation, balance deduction after transfer, and sufficient balance checks.The enoughBalance pattern is newly designed in this paper.
- Contract Graph Normalization: Node normalization removes normal and fallback nodes while passing their features to nearest core nodes and redirecting connected edges accordingly.A normal node with multiple nearest core nodes passes its feature to all of them.
- Contract Graph Construction: Contract graphs represent critical and auxiliary program elements as core, normal, and fallback nodes, with control-flow, data-flow, and fallback edges ordered temporally.Core nodes encode vulnerability-relevant invocations and variables, while normal nodes capture auxiliary elements and the fallback node simulates a virtual attack contract’s fallback function.
- Vulnerability Detection: Temporal graph processing follows the ordered edges, extracts a graph feature, and fuses it with the expert-pattern feature through the CGE network.The fused representation is processed by fully connected and sigmoid layers to output vulnerability results.
5 EXPERIMENTS
Experiments evaluate vulnerability detection across Ethereum and VNT Chain contracts, comparing CGE with conventional tools and neural alternatives. Results indicate that graph features, graph normalization, and expert security patterns contribute to improved detection, including for sharing-variable reentrancy.
- Experimental Setup: The evaluation covers Ethereum contracts with verified source code and all available smart contracts on VNT Chain, targeting reentrancy, infinite loop, and timestamp dependence vulnerabilities.The experiments address accuracy, precision, recall, and F1 score against state-of-the-art conventional approaches.
- State-of-the-art Comparison: 83.21% accuracy and 82.13% F1 score are achieved by CGE for infinite loop detection, compared with 59.56% and 53.87% for Looper and 74.61% and 74.10% for TMP.The authors attribute the improvement to modeling key variables and rich dependencies between program elements.
- Case Study: Existing reentrancy detectors can miss sharing-variable reentrancy because fixed rules overlook dependencies between variables.CGE detects the illustrated vulnerability, whereas several conventional tools fail or produce warnings at incorrect locations.
- Neural Network Comparison: Graph neural networks GCN, DR-GCN, and TMP outperform conventional methods, while Vanilla-RNN, LSTM, and GRU perform relatively worse than those conventional methods.The comparison evaluates accuracy, recall, precision, and F1 score across the tested vulnerability tasks.
- Ablation Study: Graph normalization improves CGE reentrancy detection by 2.81% in accuracy and 2.55% in F1 score.Removing normalization produces the CGE-WON variant used for this comparison.
- Ablation Study: Removing graph normalization lowers performance, and ROC analysis reports a 0.03 AUC increase for CGE on reentrancy detection.The findings suggest that program elements should contribute distinctly rather than equally to vulnerability detection.
- Ablation Study: CGE remains superior to CGE-WOE across reentrancy training epochs, and results across all three vulnerabilities support incorporating expert security patterns.The study also evaluates removing contract-graph feature extraction and alternative feature-fusion networks.
- Ablation Study: Security patterns improve neural-network performance: DR-GCN-EP gains 4.92% average accuracy over DR-GCN, and LSTM-EP gains 6.91% over LSTM.CGE consistently outperforms the other tested approaches, with DR-GCN-EP ranking second.
6 DISCUSSIONS
The discussion highlights smart-contract-specific execution and graph-design considerations. The method models vulnerability-related syntax, variables, invocations, temporal edge order, and fallback behavior in its contract graph.
- Smart-Contract Specificity: Infinite loops are studied because execution consumes gas, making wasted computation a smart-contract-specific vulnerability concern.Gas is approximately proportional to the amount of code executed.
- Contract Graph: The implementation treats call.value and block.timestamp as specially designed smart-contract syntax and distinguishes core nodes from normal nodes.Core nodes symbolize invocations and variables closely related to a specific vulnerability.
- Contract Graph: Fallback behavior is explicitly represented because unmatched function signatures and money transfers can trigger a contract's fallback function.This mechanism is presented as distinct from ordinary programming-language function dispatch.
- Contract Graph: The contract graph differs from conventional program representations by modeling vulnerability-related variables and invocations, temporal edge order, and fallback nodes.Nodes are categorized as core, normal, or fallback nodes, while edges follow temporal order in the code.
7 CONCLUSION AND FUTURE WORK
The paper presents a fully automated function-level detector that combines expert patterns with contract-graph semantics and graph neural networks. Experiments show that this approach significantly outperforms existing tools and neural-network methods.
- The proposed approach performs smart contract vulnerability detection fully automatically at the function level.
- It combines expert patterns, contract-graph semantics, rich program-element dependencies, and explicit modeling of smart-contract fallback mechanisms.
- Graph neural networks learn graph features from contract graphs containing rich control- and data-flow semantics.
- Extensive experiments show significant improvements over state-of-the-art vulnerability-detection tools and other neural-network-based methods.
- Future work will extend detection to bytecode-only contracts and investigate the architecture for additional vulnerabilities.