SCsVulSegLytix: Detecting and extracting vulnerable segments from smart contracts using weakly-supervised learning
Bibliographic record
Abstract
Smart contracts (SCs), self-executing digital contracts deployed on blockchain networks, are becoming increasingly more prevalent in various sectors, such as finance, thanks to their automation, transparency, and cost efficiency. Given the substantial size of assets managed by them, SCs have become attractive targets for hackers, who exploit vulnerabilities in them to steal funds. Blockchain’s inherent immutability means vulnerabilities cannot be fixed quickly, and the immaturity of the Solidity programming language, which introduces potential security threats to SCs, exacerbates this problem. As such, there is a pressing need to develop security measures to identify vulnerabilities in SCs. Non-learning-based detection methods utilizing heuristics designed by experts often cannot handle the evolving complexity of SC vulnerabilities. In contrast, though typically outperforming non-learning-based solutions, learning-based solutions generally do not pinpoint the locations of vulnerabilities in SCs. Learning-based approaches that identify the locations of vulnerabilities come with several challenges: First, they convert SCs into graphs, incurring computational overhead and making the learning system more complex. Second, most require line- or function-level labels to be trained, which are difficult to gather. Lastly, their coverage of vulnerability types is not extensive, exposing the user to vulnerabilities not covered by them. This work presents SCsVulSegLytix, a learning-based approach for detecting and extracting vulnerable segments in SCs. SCsVulSegLytix uses a source code-based Transformer model trained with contract-level labels to classify entire contracts as vulnerable, followed by a post-hoc interpretability method to extract vulnerable segments in SCs according to relevance scores. Unlike previous extraction models, SCsVulSegLytix requires no line-level annotations and can be trained using contract-wide labels only, which are much easier to collect. Moreover, it operates directly on Solidity source code, substantially improving efficiency compared to expensive graph-based models. Finally, it extends support to several important classes of SC vulnerabilities, meaning developers are protected against various potential attacks. Experiments show that our model outperforms existing models concerning both contract- and line-level vulnerability identification while achieving greater computation efficiency.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.001 | 0.000 |
| Scholarly communication | 0.000 | 0.000 |
| Open science | 0.000 | 0.000 |
| Research integrity | 0.000 | 0.001 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".