Abstract:Smart contracts have been widely used in the blockchain world these years, and simultaneously vulnerability detection has gained more and more attention due to the staggering economic losses caused by the attacker. Existing tools that analyze vulnerabilities for smart contracts heavily rely on rules predefined by experts, which are labour-intense and require domain knowledge. Moreover, predefined rules tend to be misconceptions and increase the risk of crafty potential back-doors in the future. Recently, researchers mainly used static and dynamic execution analysis to detect the vulnerabilities of smart contracts and have achieved acceptable results. However, the dynamic method cannot cover all the program inputs and execution paths, which leads to some vulnerabilities that are hard to detect. The static analysis method commonly includes symbolic execution and theorem proving, which requires using constraints to detect vulnerability. These shortcomings show that traditional methods are challenging to apply and expand on a large scale. This paper aims to detect vulnerabilities via the Bug Injection framework and transfer learning techniques. First, we train a Transformer encoder using multi-modality code, which contains source code, intermediate representation, and assembly code. The input code consists separately of Solidity source code, intermediate representation, and assembly code. Specifically, we translate source code into the intermediate representation and decompile the byte code into assembly code by the EVM compiler. Then, we propose a novel entropy embedding technique, which combines token embedding, segment embedding, and positional embedding of the Transformer encoder in our approach. After that, we utilize the Bug Injection framework to automatically generate specific types of buggy code for fine-tuning and evaluating the performance of vulnerability detection. The experimental results show that our proposed approach improves the performance in detecting reentrancy vulnerabilities and timestamp dependence. Moreover, our approach is more flexible and scalable than static and dynamic analysis approaches in detecting smart contract vulnerabilities. Our approach improves the baseline approaches by an average of 11.89% in term of F1 score.

Smart Contract Vulnerability Detection Based on Multi-Scale Encoders

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

VDDL: A Deep Learning-Based Vulnerability Detection Model for Smart Contracts.

Smart Contract Vulnerability Detection Technique: A Survey

ConvMHSA-SCVD: Enhancing Smart Contract Vulnerability Detection Through a Knowledge-Driven and Data-Driven Framework

Smart Contract Vulnerability Detection Based on Multimodal Feature Fusion

Cross-Modality Mutual Learning for Enhancing Smart Contract Vulnerability Detection on Bytecode

Optimizing smart contract vulnerability detection via multi-modality code and entropy embedding

Smart Contract Vulnerability Detection Based on Deep Learning and Multimodal Decision Fusion

Smart Contract Vulnerability Detection: From Pure Neural Network to Interpretable Graph Feature and Expert Pattern Fusion

An Efficient Code-Embedding-Based Vulnerability Detection Model for Ethereum Smart Contracts

A Smart Contract Vulnerability Detection Method Based on Multimodal Feature Fusion and Deep Learning

Ethereum Smart Contract Vulnerability Detection Model Based on Triplet Loss and BiLSTM

Smart Contract Vulnerability Detection Model Based on Multi-Task Learning

EDSCVD: Enhanced Dual-Channel Smart Contract Vulnerability Detection Method

Smart Contract Vulnerability Detection Based on Multi Graph Convolutional Neural Networks with Self-attention

A Smart Contract Vulnerability Detection Model Based on Syntactic and Semantic Fusion Learning

Robust Vulnerability Detection in Solidity-Based Ethereum Smart Contracts Using Fine-Tuned Transformer Encoder Models

Deep learning-based methodology for vulnerability detection in smart contracts

SPCBIG-EC: A Robust Serial Hybrid Model for Smart Contract Vulnerability Detection

A New Smart Contract Anomaly Detection Method by Fusing Opcode and Source Code Features for Blockchain Services