基于漏洞关键代码的智能合约漏洞检测方法

彭涛; 吴胜

doi:10.11907/rjdk.241972

您当前的位置：

首页 >

文章列表页 >

基于漏洞关键代码的智能合约漏洞检测方法

计算机软件与理论 | 更新时间：2026-02-09

- 基于漏洞关键代码的智能合约漏洞检测方法
- Smart Contract Vulnerability Detection Method Based on Vulnerability Critical Code
- 软件导刊 2026年25卷第2期页码：110-118
- 作者机构：
  
  江苏师范大学计算机科学与技术学院，江苏徐州 221116
- 作者简介：
  
  彭涛（1997-），男，江苏师范大学计算机科学与技术学院硕士研究生，研究方向为软件漏洞检测
  吴胜（1978-），男，博士，江苏师范大学计算机科学与技术学院副教授、硕士生导师，研究方向为区块链、软件工程。。
- 基金信息：
  
  江苏师范大学研究生科研与实践创新计划项目(2024XKT2599)
- DOI：10.11907/rjdk.241972
  中图分类号： TP309
- 收稿：2025-01-04，
  
  纸质出版：2026-02-26
- 稿件说明：
移动端阅览
彭涛,吴胜.基于漏洞关键代码的智能合约漏洞检测方法[J].软件导刊,2026,25(02):110-118.

PENG Tao,WU Sheng.Smart Contract Vulnerability Detection Method Based on Vulnerability Critical Code[J].Software Guide,2026,25(02):110-118.
彭涛,吴胜.基于漏洞关键代码的智能合约漏洞检测方法[J].软件导刊,2026,25(02):110-118. DOI： 10.11907/rjdk.241972.

PENG Tao,WU Sheng.Smart Contract Vulnerability Detection Method Based on Vulnerability Critical Code[J].Software Guide,2026,25(02):110-118. DOI： 10.11907/rjdk.241972.

摘要

智能合约在多个领域均取得了显著进展，而确保其安全性和可靠性显得尤为关键，这能够有效防范潜在的财务损失风险。鉴于智能合约具有不可篡改的特性，在其部署前开展漏洞检测至关重要。尽管已有很多漏洞检测工具，但它们大多依赖于静态的方法和预定义好的规则，并且检测过程需要大量时间。鉴于此，提出一种基于漏洞关键代码和深度学习框架的智能合约漏洞检测模型。该方法使用抽象语法树构建具有完整语义结构信息的漏洞关键代码，以增加表达漏洞特征的能力。并且，采用可拓展的深度学习特征提取模型，包括LSTM、GRU、Bi-LSTM和Bi-LSTM-Atten，以提高智能合约漏洞检测性能。针对以太坊智能合约重入漏洞的真实数据集进行训练和测试，实验结果显示，该方法优于常用的Mythril、Oyent、Smartcheck、TMP、CGE、DeeSCVH等6种方法，准确率达94.32%，F1分数达88.69%。研究表明，漏洞关键代码显著增强了该模型检测效果，提升了漏洞检测效率。

Abstract

Smart contracts have made significant progress in various fields and it is vital to ensure their security and reliability to prevent potential financial losses. Due to the non-tamperability， it is important to perform vulnerability detection before smart contracts are deployed. Although many vulnerability detection tools are available， most of them rely on static methods and predefined rules， and the detection process takes a lot of time. In this paper， we propose a smart contract vulnerability detection model based on vulnerability critical code and deep learning framework. The method uses abstract syntax trees to construct vulnerability key codes with complete semantic structure information to increase the ability to express vulnerability features. And it uses extensible deep learning feature extraction models， including LSTM， GRU， Bi-LSTM and Bi-LSTM-Atten， to improve the performance of smart contract vulnerability detection. Training and testing are performed on a real dataset of Ethernet smart contract reentry vulnerabilities， and the experimental results show that this paper's method outperforms six commonly used methods， including Mythril， Oyent， Smartcheck，TMP，CGE，and DeeSCVH， and achieves an accuracy rate of 94.32% and an F1 score of 88.69%.The research shows that the vulnerability critical code has significantly enhanced the detection performance of this model，and the efficiency of vulnerability detection has been improved.

关键词

Keywords

references

KHAN S N ， LOUKIL F ， GHEDIRA G C ， et al . Blockchain smart contracts： applications，challenges，and future trends ［J］. Peer-to-Peer Networking and Applications ， 2021 ， 14 ： 2901 - 2925 . doi: 10.1007/s12083-021-01127-0 http://dx.doi.org/10.1007/s12083-021-01127-0

BUTERIN V . A next-generation smart contract and decentralized application platform ［Z］. Ethereum White Paper ， 2014：1-36 .

ZOHAR A . Bitcoin： under the hood ［J］. Communications of the ACM ， 2015 ， 58 （ 9 ）： 104 - 113 . doi: 10.1145/2701411 http://dx.doi.org/10.1145/2701411

TheDAOcontract ［EB/OL］. https：//etherscan.io/address/0xbb9bc244d798123fde783fcc1c72d3bb8c189413 https://etherscan.io/address/0xbb9bc244d798123fde783fcc1c72d3bb8c189413 . doi: 10.47939/et.v1i1.18 http://dx.doi.org/10.47939/et.v1i1.18

QIAN P ， LIU Z ， HE Q ， et al . Smart contract vulnerability detection technique： a survey ［DB/OL］. https：//arxiv.org/abs/2209.05872 ， 2022 . doi: 10.1145/3543507.3583367 http://dx.doi.org/10.1145/3543507.3583367

MOSSBERG M ， MANZANO F ， HENNENFENT E ， et al . Manticore： a user-friendly symbolic execution framework for binaries and smart contracts ［C］// 2019 34th IEEE/ACM International Conference on Automated Software Engineering ， 2019 ： 1186 - 1189 . doi: 10.1109/ase.2019.00133 http://dx.doi.org/10.1109/ase.2019.00133

DHAWAN M . Analyzing safety of smart contracts ［C］// Proceedings of the Conference：Network and Distributed System Security Symposium ， 2017 ： 16 - 17 . doi: 10.14722/ndss.2018.23082 http://dx.doi.org/10.14722/ndss.2018.23082

LUU L ， CHU D H ， OLICKEL H ， et al . Making smart contracts smarter ［C］// Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security ， 2016 ： 254 - 269 . doi: 10.1145/2976749.2978309 http://dx.doi.org/10.1145/2976749.2978309

JIANG B ， LIU Y ， CHAN W K . Contractfuzzer：fuzzing smart contracts for vulnerability detection ［C］// Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering ， 2018 ： 259 - 269 . doi: 10.1145/3238147.3238177 http://dx.doi.org/10.1145/3238147.3238177

LIPTON Z C . A critical review of recurrent neural networks for sequence learning ［DB/OL］. https：//arxiv.org/abs/1506.00019 ， 2015 .

WU Z ， PAN S ， CHEN F ， et al . A comprehensive survey on graph neural networks ［J］. IEEE Transactions on Neural Networks and Learning Systems ， 2020 ， 32 （ 1 ）： 4 - 24 . doi: 10.1109/tnnls.2020.2978386 http://dx.doi.org/10.1109/tnnls.2020.2978386

STAUDEMEYER R C ， MORRIS E R . Understanding LSTM-a tutorial into long short-term memory recurrent neural networks ［DB/OL］. https：//arxiv.org/abs/1909.09586 ， 2019 .

DEY R ， SALEM F M . Gate-variants of gated recurrent unit （GRU） neural networks ［C］// 2017 IEEE 60th International Midwest Symposium on Circuits and Systems ， 2017 ： 1597 - 1600 . doi: 10.1109/mwscas.2017.8053243 http://dx.doi.org/10.1109/mwscas.2017.8053243

SHERSTINSKY A . Fundamentals of recurrent neural network （RNN） and long short-term memory （LSTM） network ［J］. Physica D： Nonlinear Phenomena ， 2020 ， 404 ： 132306 . doi: 10.1016/j.physd.2019.132306 http://dx.doi.org/10.1016/j.physd.2019.132306

VASWANI A . Attention is all you need ［DB/OL］. https：//arxiv.org/abs/1706.03762 ， 2017 .

ANTLR ［EB/OL］. http：//www.antlr.org/ http://www.antlr.org/ . doi: 10.5220/0011623000003402 http://dx.doi.org/10.5220/0011623000003402

GARFATTA I ， KLAI K ， GAALOUL W ， et al . A survey on formal verification for solidity smart contracts ［C］// Proceedings of the 2021 Australasian Computer Science Week Multiconference ， 2021 ： 1 - 10 . doi: 10.1145/3437378.3437879 http://dx.doi.org/10.1145/3437378.3437879

TSANKOV P ， DAN A ， DRACHSLER C D ， et al . Securify： practical security analysis of smart contracts ［C］// Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security ， 2018 ： 67 - 82 . doi: 10.1145/3243734.3243780 http://dx.doi.org/10.1145/3243734.3243780

Mythril：an open-source security analysis tool for ethereum smart contracts ［EB/OL］. https：//github.com/ConsenSys/mythril https://github.com/ConsenSys/mythril . doi: 10.5220/0012858000003767 http://dx.doi.org/10.5220/0012858000003767

KLEES G ， RUEF A ， COOPER B ， et al . Evaluating fuzz testing ［C］// Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security ， 2018 ： 2123 - 2138 . doi: 10.1145/3243734.3243804 http://dx.doi.org/10.1145/3243734.3243804

FEIST J ， GRIECO G ， GROCE A . Slither： a static analysis framework for smart contracts ［C］// 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain ， 2019 ： 8 - 15 . doi: 10.1109/wetseb.2019.00008 http://dx.doi.org/10.1109/wetseb.2019.00008

GUPTA R ， PATEL M M ， SHUKLA A ， et al . Deep learning-based malicious smart contract detection scheme for internet of things environment ［J］. Computers & Electrical Engineering ， 2022 ， 97 ： 107583 . doi: 10.1016/j.compeleceng.2021.107583 http://dx.doi.org/10.1016/j.compeleceng.2021.107583

QIAN P ， LIU Z ， HE Q ， et al . Towards automated reentrancy detection for smart contracts based on sequential models ［J］. IEEE Access ， 2020 ， 8 ： 19685 - 19695 . doi: 10.1109/access.2020.2969429 http://dx.doi.org/10.1109/access.2020.2969429

HAO X ， REN W ， ZHENG W ， et al . SCScan： a SVM-based scanning system for vulnerabilities in blockchain smart contracts ［C］// 2020 IEEE 19th International Conference on Trust，Security and Privacy in Computing and Communications ， 2020 ： 1598 - 1605 . doi: 10.1109/trustcom50675.2020.00221 http://dx.doi.org/10.1109/trustcom50675.2020.00221

HUANG H ， GUO L ， ZHAO L ， et al . Effective combining source code and opcode for accurate vulnerability detection of smart contracts in edge AI systems ［J］. Applied Soft Computing ， 2024 ， 158 ： 111556 . doi: 10.1016/j.asoc.2024.111556 http://dx.doi.org/10.1016/j.asoc.2024.111556

ASHIZAWA N ， YANAI N ， CRUZ J P ， et al . Eth2Vec： learning contract-wide code representations for vulnerability detection on ethereum smart contracts ［C］// Proceedings of the 3rd ACM International Symposium on Blockchain and Secure Critical Infrastructure ， 2021 ： 47 - 59 . doi: 10.1145/3457337.3457841 http://dx.doi.org/10.1145/3457337.3457841

ZHANG H ， ZHANG W ， FENG Y ， et al . SVScanner： detecting smart contract vulnerabilities via deep semantic extraction ［J］. Journal of Information Security and Applications ， 2023 ， 75 ： 103484 . doi: 10.1016/j.jisa.2023.103484 http://dx.doi.org/10.1016/j.jisa.2023.103484

ZHUANG Y ， LIU Z ， QIAN P ， et al . Smart contract vulnerability detection using graph neural networks ［C］// Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intelligence ， 2021 ： 3283 - 3290 . doi: 10.24963/ijcai.2020/454 http://dx.doi.org/10.24963/ijcai.2020/454

HUANG T T H D . Hunting the ethereum smart contract： color-inspired inspection of potential attacks ［DB/OL］. https：//arxiv.org/abs/1807.01868 ， 201 .

ZHEN Z ， ZHAO X ， ZHANG J ， et al . DA-GNN： a smart contract vulnerability detection method based on dual attention graph neural network ［J］. Computer Networks ， 2024 ， 242 ： 110238 . doi: 10.1016/j.comnet.2024.110238 http://dx.doi.org/10.1016/j.comnet.2024.110238

CAI J ， LI B ， ZHANG J ， et al . Combine sliced joint graph with graph neural networks for smart contract vulnerability detection ［J］. Journal of Systems and Software ， 2023 ， 195 ： 111550 . doi: 10.1016/j.jss.2022.111550 http://dx.doi.org/10.1016/j.jss.2022.111550

LIU H ， FAN Y ， FENG L ， et al . Vulnerable smart contract function locating based on multi-relational nested graph convolutional network ［J］. Journal of Systems and Software ， 2023 ， 204 ： 111775 . doi: 10.1016/j.jss.2023.111775 http://dx.doi.org/10.1016/j.jss.2023.111775

YU X ， ZHAO H ， HOU B ， et al . DeeSCVHunter： a deep learning-based framework for smart contract vulnerability detection ［C］// 2021 International Joint Conference on Neural Networks（IJCNN）， 2021 ： 1 - 8 . doi: 10.1109/ijcnn52387.2021.9534324 http://dx.doi.org/10.1109/ijcnn52387.2021.9534324

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

物联网固件漏洞检测技术综述

基于十字绣单元与多任务学习的人格预测方法

深度学习驱动的轻量化医疗图像压缩模型

基于多尺度注意力融合的声音事件定位与检测

SESSC-DL-MTSK：带有新型模糊化操作的TSK模糊系统