These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Due to the immutable and decentralized nature of Ethereum (ETH) platform,
smart contracts are prone to security risks that can result in financial loss.
While existing machine learning-based vulnerability detection algorithms
achieve high accuracy at the contract level, they require developers to
manually inspect source code to locate bugs. To this end, we present G-Scan,
the first end-to-end fine-grained line-level vulnerability detection system
evaluated on the first-of-its-kind real world dataset. G-Scan first converts
smart contracts to code graphs in a dependency and hierarchy preserving manner.
Next, we train a graph neural network to identify vulnerable nodes and assess
security risks. Finally, the code graphs with node vulnerability predictions
are mapped back to the smart contracts for line-level localization. We train
and evaluate G-Scan on a collected real world smart contracts dataset with
line-level annotations on reentrancy vulnerability, one of the most common and
severe types of smart contract vulnerabilities. With the well-designed graph
representation and high-quality dataset, G-Scan achieves 93.02% F1-score in
contract-level vulnerability detection and 93.69% F1-score in line-level
vulnerability localization. Additionally, the lightweight graph neural network
enables G-Scan to localize vulnerabilities in 6.1k lines of code smart contract
within 1.2 seconds.