DAppSCAN: Building Large-Scale Datasets for Smart Contract Weaknesses in DApp Projects

Vulnerable smart contract function locating based on Multi-Relational Nested Graph Convolutional Network

The inception of blockchain techniques has been revolutionizing various domains, e.g., Internet of Things, supply chain and healthcare. Ethereum smart contracts emerge as the promising blockchain application, which could enable distrustful parties to participate in the automatic and trustful transactions. Given the increasing importance of Ethereum smart contracts, understanding them becomes imperative. However, prior work only studied smart contracts with general high-level patterns, and one critical question has not been answered yet: how do smart contracts behave individually? In this paper, we present a behavior-aware profiling of individual smart contract from a multi-party perspective, which improves the visibility of the smart contract ecosystem. We conduct a detailed study of the behavior of individual smart contract on two real-world datasets, and our profiling reveals interesting and surprising observations. For example, a few contract completion chains have more than 50 contracts and all of them belong to the Finance category. We also discuss the implications that lead to recommendations to improve the security and performance of the smart contract ecosystem. Overall, our work effectively complements previous work towards generating a comprehensive understanding of smart contracts.

Security attacks in smart contracts have drawn extensive attention due to the financial loss and erosion of trust caused by vulnerabilities. Even worse, smart contract is a tamper proof digital agreement and fixing bugs in it is difficult, so it is necessary for developers to detect security vulnerabilities in smart contract before deployment. Researchers have proposed several methods on smart contract vulnerability detection. However, despite the numerous vulnerability-finding tools, few of them have ideal detection performance because most of them rely on fixed rules, which is inefficient. In this paper, a modularized and systematic Deep Learning-based framework is proposed to automatically detect smart contracts vulnerability, called DeeSCVHunter. Particularly, we focus on two types of smart contract vulnerabilities: reentrancy and time dependence. And we propose a novel notion of Vulnerability Candidate Slice (VCS) to help models capture the key point of vulnerability. We conduct experiments on real-world dataset and the results prove the effectiveness of VCS, which leads to 25.76% improvement in F1-score at most. And extensive experiments also show that our proposed framework significantly outperforms state-of-the-art methods.

The blockchain 2.0 age, marked by smart contract and Ethereum, has arrived couple years ago. Its technologies have expanded the application scenarios of blockchain technology and driven the boom of decentralized Finance. However, smart contract vulnerabilities and security issues are also emerging one after another. Hackers have exploited these vulnerabilities to cause huge economic losses. In recent years, a large amount of research on the analysis and detection of smart contract vulnerabilities has emerged, but there has been no common detection tool and corresponding test dataset. In this paper, we build GSVD dataset (Generalized Smart Contract Vulnerability Dataset) consisting four offline datasets using smart contracts on two chains, Polygon and BSC: two small Solidity datasets consisting of 153 labeled smart contract source codes, which can be used to test the performance of vulnerability mining tools; two large Solidity datasets consisting of 52,202 un labeled real smart contract source codes that can be used to verify the correctness of various theories and tools under a large number of real data conditions. At the same time, this paper integrates the scripting framework accompanying the GSVD dataset, which can execute a variety of popular automated vulnerability detection tools on top of these datasets and generate analysis results of contracts and potential vulnerabilities. We tested the Minor dataset under GSVD using three tools (Slither, Manticore, Mythril) that are kept up to date and found that the combined use of all tools detected 61.1% of labeled vulnerabilities, of which Mythril has the highest detection rate of 42.6%. It is not difficult to conclude that there`re still ample room for advancement for current smart contract vulnerability mining tools because of their underlying methods. Besides, our dataset can contribute to the ultimate target greatly by providing mining tools plenty real contracts information.

Despite the great potential capabilities and the mature technological solutions, the smart contracts have never been used at a large scale, one of the reasons being the lack of good methods to verify the correctness and security of the contracts—although the technology itself (e.g. the Ethereum platform) is well studied and secure, the actual smart contracts are human-made and thus inherently error-prone. As a consequence, critical vulnerabilities in the contracts are discovered and exploited every few months. The most prominent example of a buggy contract was the infamous DAO attack—a successful attack on the largest Ethereum contract in June 2016 resulting in $70 mln-worth Ether stolen and the hard fork of the Ethereum network (80% of Ethereum users decided to revert the transaction and hence two parallel transaction histories exist from that event).The main contribution of this work is the automatic method of formal verification of randomized Ethereum smart contracts. We formally define and implement the translation of the contracts into MDP (Markov decision process) formal models which can be verified using the PRISM model checker—a state of the art tool for formal verification of models. As a proof of concept, we use our tool, EthVer, to verify two smart contracts from the literature: the Rock-Paper-Scissors protocol from K. Delmolino et al., Step by step towards creating a safe smart contract: Lessons and insights from a cryptocurrency lab. and the Micropay 1 protocol from R. Pass, a. shelat, Micropayments for decentralized currencies.

Smart contracts — self-executing agreements expressed in blockchain code — are transacting billions of dollars of value daily, yet their legal enforceability under Indian law remains fundamentally uncertain. This article undertakes a systematic doctrinal analysis of smart contracts against the essential requirements of a valid contract under the Indian Contract Act, 1872 (“ICA”) and the authentication and evidentiary framework of the Information Technology Act, 2000 (“IT Act”). The analysis demonstrates that the ICA’s core requirements — offer and acceptance, consideration, capacity, free consent, and legality — can each be satisfied in a smart contract interaction when interpreted in light of the blockchain’s technical architecture. This article proposes the “Informed Interaction Standard” as a workable judicial test for offer and acceptance. It identifies two critical gaps in the IT Act: the non-recognition of blockchain cryptographic authentication as a valid electronic signature and the inapplicability of the Section 65B evidentiary certificate requirement to blockchain records. To address these gaps, the article proposes three targeted legislative interventions: a new Section 10B (IT Act) expressly validating smart contracts; a Section 3A notification recognising blockchain authentication; and a new Section 65C establishing an alternative evidentiary certification pathway for distributed ledger records. Comparative analysis of England, the United States, Singapore, and the European Union confirms that India is an outlier in its failure to resolve these questions and benchmarks the proposed reforms against best international practice. Keywords: smart contracts, Indian Contract Act 1872, Information Technology Act 2000, blockchain law, decentralised finance, digital signatures, Section 65B, electronic contracts, DAO, law reform.

Digital Solidarity: Contracting in the Age of Smart Contracts

With the wide application of smart contracts in many fields, the number, types, and complexity of smart contracts are showing a rapidly increasing trend. However , the development of smart contracts has its own unique programming language and security requirements, which are difficult for conventional software personnel to adapt to quickly, and how to realize the efficient development of smart contracts according to the application requirements is an important issue that needs to be solved for its further development. To this end, this paper proposes a smart contract generation method based on AST-LSTM characterization and code annotation tuning large language model, which adopts AST-LSTM model combining Abstract Syntax Tree (AST) and Tree-LSTM to vectorize the code as well as Sentence-Bert to vectorize the annotations and carry out a weighted analysis, and constructs a smart contract clustering analysis model to achieve accurate clustering of functionally similar smart contracts. Then the AST-LSTM+Transformer model is used to detect defects in the clustered code and correlate the related annotation information to construct a diverse Prompt feature prompt statement dataset. Finally, the LLaMA2-7B model is used as the basis for demand-specific smart contract generation with the help of Lora and P-Tuning v2 fine-tuning techniques. In this paper, with the help of BLEU, an auxiliary tool for bilingual translation quality assessment, and Mythril, VaaS, 1 and other code security detection tools, we conducted comparative experiments with existing methods. The results of the experiment show that the average value of BLEU of the code generated by this paper’s method is improved by about 25%, and the code security is improved by about 9%, which will greatly promote the rapid development and exploitation of smart contracts with high-security requirements.

Blockchain and drone technologies can operate in cooperation with each other. As the number of drones increases, managing them becomes a significant challenge. A swarm of drones, also referred to as swarm drones, must operate reliably and securely. In this study, blockchain technology is utilized through a smart contract to ensure both security and reliability. Swarm drones are deployed for surveillance missions, where each execution corresponds to a single mission. These missions are represented using a simple model. A smart contract maintains the essential mission data in the model. The mission is divided into smaller tasks. Until all the tasks are completed, they are executed by drones in parallel. The smart contract, implemented on the Ethereum platform, securely exchanges information with the drones. The proposed model functions dynamically. It reorganizes when drones leave or new drones join the system. Because blockchain platforms have limited resources, particularly in memory and the number of permissible execution operations, optimizations are applied to both the smart contract and drone programs to accommodate these constraints within the surveillance framework. The proposed surveillance model is implemented and simulated to analyze its dynamic behavior.

Smart contracts enable mutually untrusted entities to interact without relying on trusted third parties. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts. To address this issue, we have developed Securify, a scalable and fully automated security analyzer for Ethereum smart contracts. A key technical insight behind the design of Securify is that whenever a smart contract violates a security property, it often also violates a simpler property that can be expressed on the contract’s data-flow graph. To leverage this insight, Securify symbolically encodes relevant control- and data-flow dependencies in stratified Datalog and uses scalable Datalog solvers to derive key semantic facts about the contract. Then, it inspects the inferred semantic facts to checks a set of compliance and violation patterns, which capture sufficient conditions for proving if a given security property holds or not.

Blockchain and smart contract technology have led to the creation of an alternative financial system called Decentralised Finance (DeFi) which has grown exponentially in the last year alone to a current value of $76B. Without a central custodian or regulator, non-technical users may find it difficult to assess the security of their favourite projects. In this trustless environment, can the current state-of-the-art smart contract analysis tools be used by non-technical users to protect investors from incurring losses and improving the security in the space? In the paper, we review the literature focusing on well-known vulnerabilities of financial smart contracts and show the scale of successful DeFi attacks. By analysing the root cause of recent exploits of contracts, we assess the feasibility of detecting these vulnerabilities by automatic verification. We investigate 21 analysis tools for detecting vulnerabilities in smart contracts with an in-depth evaluation of six tools: Slither, Mythril, DerScanner, Manticore, Oyente and Securify v2. The tools were evaluated for their efficiency and accuracy against a custom dataset containing 28 vulnerable and 16 healthy smart contracts and are ultimately rated based on how useful they may be from a DeFi user perspective. The results indicate that, while Slither received the highest rating, none of the existing tools can successfully assist DeFi users at present due to lack of reliability or lack of simplicity for the targeted market.

The number of applications supported by blockchain smart contracts has been greatly increasing in recent years, with smart contracts now being used across several domains, such as the music industry, finance, and retail, to name a few. Despite being used in business-critical contexts, the number of security vulnerabilities in smart contracts has also been increasing, with many of them being exploited and resulting in huge financial and reputation losses. This is despite the enormous effort that is being placed into the research and development of vulnerability detection tools and techniques, which have also greatly increased in number and type in the last few years. Motivated by the recent increase in both vulnerabilities and vulnerability detection techniques, this paper reviews the latest research in smart contract vulnerability detection, emphasizing the techniques being used, the vulnerabilities targeted, and the characteristics of the dataset used for evaluating the technique. We mapped the vulnerabilities against two common vulnerability classification schemes (DASP and SWC) and performed a consolidated analysis. We identified the current research trends and gaps in each technique and highlighted future research opportunities in the field.

The classification of the smart contract can effectively reduce the search space and improve retrieval efficiency. The existing classification methods are based on natural language processing technologies. Because the processing of source code by these technologies lacks extraction and processing in the software engineering field, there is still a lot of room for improvement in their methods of feature extraction. Therefore, this paper proposes a multi-feature fusion method for smart contract classification (MFF-SC) based on the code processing technology. From the source code perspective, source code processing method and attention mechanism are used to extract local code features. Structure-based traversal method are used to extract global code features from abstract syntax tree. Local and global code features introduce attention mechanism to generate code semantic features. From the perspective of account transaction, the feature of account transaction is extracted by using TransR. Next, the code semantic features and account transaction features generate smart contract semantic features by an attention mechanism. Finally, the smart contract semantic features are fed into a stacked denoising autoencoder and a softmax classifier for classification. Compared with other baselines and variants, experimental results on a real-world dataset show that MFF-SC achieves an accuracy rate of 83.9%.

– The rapid proliferation of blockchain-based decentralized applications has introduced critical security challenges ranging from vulnerable smart contracts to privacy leakage in on-chain transactions. Existing tools address these challenges in isolation, leaving practitioners to integrate disparate solutions. OmniShield is a unified, open-source blockchain security platform that consolidates AI-powered smart contract vulnerability scanning, zero-knowledge proof (ZKP) private transfers, and a private QBFT consensus network into a single cohesive system. The scanner combines static pattern analysis, symbolic execution, and a Gemini-LLM reasoning layer to detect reentrancy, integer overflow, access-control flaws, and twelve other vulnerability classes with severity ratings. Private transfers leverage Groth16 zk-SNARKs over Circom circuits so balances remain hidden on-chain while cryptographic validity is enforced. The underlying network runs on Hyperledger Besu with QBFT consensus, providing Byzantine-fault-toleran block production. Experimental results show the scanner correctly identifies known vulnerabilities in benchmark contracts, ZKP proof generation completes in under 15 seconds on consumer hardware, and end-to-end private transfers finalize within two consensus rounds. OmniShield demonstrates that enterprise-grade blockchain security can be packaged as an accessible, developer-friendly platform. Key Words: blockchain security, smart contract analysis, zero-knowledge proofs, zk-SNARKs, Hyperledger Besu, QBFT consensus, AI vulnerability scanner, reentrancy, Solidity.

Ethereum smart contracts are programs that run on the Ethereum blockchain, and many smart contract vulnerabilities have been discovered in the past decade. Many security analysis tools have been created to detect such vulnerabilities, but their performance decreases drastically when codes to be analyzed are being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool for vulnerability detection, with robustness against code rewrites in smart contracts. Existing machine-learning-based static analysis tools for vulnerability detection need features, which analysts create manually, as inputs. In contrast, Eth2Vec automatically learns features of vulnerable Ethereum Virtual Machine (EVM) bytecodes with tacit knowledge through a neural network for language processing. Therefore, Eth2Vec can detect vulnerabilities in smart contracts by comparing the code similarity between target EVM bytecodes and the EVM bytecodes it already learned. We conducted experiments with existing open databases, such as Etherscan, and our results show that Eth2Vec outperforms the existing work in terms of well-known metrics, i.e., precision, recall, and F1-score. Moreover, Eth2Vec can detect vulnerabilities even in rewritten codes.