Safeguarding smart contracts is paramount to the security of the blockchain ecosystem. In recent years, numerous studies have employed deep learning techniques to detect vulnerabilities in smart contracts based on their bytecode. However, such approaches are primarily limited by inherent code redundancy and coarse-grained contract labeling. The former (e.g., auxiliary stack manipulations) dilutes vulnerability-revealing cues in each contract, whereas the latter hinders models from distinguishing the vulnerable contract from benign execution ones. To address these limitations, we propose SD-MIL, a two-stage de-noising detection framework based on Ethereum smart contract bytecode. In the static de-noising stage, SD-MIL employs a target-driven computation strand extraction algorithm to remove irrelevant code segments with respect to critical operation targets, and augments the resulting strands with abstract symbolic expressions to enrich the semantic representation of low-level bytecode with high-level intent. In the dynamic de-noising stage, SD-MIL adopts a detection model with semantic-gated multi-instance learning architecture, where computation strands augmented with symbolic expressions are treated as instances and the contribution of each strand is dynamically calibrated to focus on vulnerability-relevant patterns. Experiments on a real-world dataset covering five vulnerability types demonstrate the effectiveness of SD-MIL, achieving 0.9401 accuracy and 0.9268 F1-score. SD-MIL surpasses traditional static analysis tools with average improvements of 30.28% in accuracy and $\mathbf{2 8. 6 4 \%}$ in F1-score, and outperforms deep learning baselines by 8.46% in accuracy and 8.18% in F1-score.
Jiaying Xie, Yanxiang Tong, Xiao Wang et al.· Annual International Compute...· 0 citations
As a core technology in blockchain-based systems, smart contracts are widely used in various fields. Meanwhile, their post-deployment immutability and financial nature render vulnerabilities attractive to attackers, as evidenced by significant economic losses, making smart contract vulnerability detection a critical task. Traditional detection tools mainly rely on vulnerability patterns derived from static program analysis, but are limited by expert experience and exhibit poor scalability. Recently, Large Language Models (LLMs) have emerged as a new solution for identifying smart contract vulnerabilities due to their remarkable capabilities in code understanding and reasoning. However, current prompting-based approaches are often restricted by high token overhead and the lack of domain-specific knowledge. To this end, this paper proposes an LLM-driven approach for detecting vulnerabilities in Ethereum smart contracts. First, we construct a heterogeneous graph that fuses control flow graphs (CFGs) and data flow graphs (DFGs) to capture the execution logic and transaction behavior of each smart contract with significantly reduced token consumption. Second, we leverage LLMs to extract key paths from each heterogeneous graph to filter out branches unrelated to vulnerabilities. Third, we build a knowledge repository based on the extracted key paths of both vulnerable and non-vulnerable smart contracts, together with a dual-metric retrieval mechanism. Finally, we design a Chain-of-Thought (CoT)-based prompt to guide vulnerability detection using the target smart contract's retrieved similar paths. Experiments on a public dataset of 1,093 smart contracts demonstrate the effectiveness of our approach, outperforming traditional tools by average improvements of 25.75% in accuracy and 31.44% in F1 score. Compared with LLM-based baselines, our approach achieves average improvements of 21.89% in accuracy and 26.91% in F1 score, along with a decrease of 52.88% in token consumption.
Yunhan Zhang, Yanxiang Tong, Ben Wang et al.· Annual International Compute...· 0 citations