Due to the immutable and decentralized nature of Ethereum (ETH) platform,
smart contracts are prone to security risks that can result in financial loss.
While existing machine learning-based vulnerability detection algorithms
achieve high accuracy at the contract level, they require developers to
manually inspect source code to locate bugs. To this end, we present G-Scan,
the first end-to-end fine-grained line-level vulnerability detection system
evaluated on the first-of-its-kind real world dataset. G-Scan first converts
smart contracts to code graphs in a dependency and hierarchy preserving manner.
Next, we train a graph neural network to identify vulnerable nodes and assess
security risks. Finally, the code graphs with node vulnerability predictions
are mapped back to the smart contracts for line-level localization. We train
and evaluate G-Scan on a collected real world smart contracts dataset with
line-level annotations on reentrancy vulnerability, one of the most common and
severe types of smart contract vulnerabilities. With the well-designed graph
representation and high-quality dataset, G-Scan achieves 93.02% F1-score in
contract-level vulnerability detection and 93.69% F1-score in line-level
vulnerability localization. Additionally, the lightweight graph neural network
enables G-Scan to localize vulnerabilities in 6.1k lines of code smart contract
within 1.2 seconds.