Mining Characteristics of Vulnerable Smart Contracts across Lifecycle Stages

Abstract

Smart contracts are the cornerstone of decentralized applications and financial protocols, extending digital currency transactions but also introducing serious security challenges that cause substantial economic losses. Existing solutions primarily target code-level vulnerabilities, which constitute only a portion of all security incidents. Though prior research conducts static analysis across contract lifecycles, they lack the characteristic analysis of vulnerabilities in each stage and the distinction between the vulnerabilities. This paper presents the first empirical study on the security of smart contracts throughout their lifecycle, including deployment and execution, upgrade, and destruction stages. We propose two feature categories: transaction features (contract lifespan and four dynamic features: transaction numbers, transaction amounts, neighbour numbers, and the number of old and new neighbours) and ego network properties (temporal network density and local clustering coefficient). These seven features capture behavioural patterns across dimensions, including activity duration, transaction frequency, financial liquidity, interaction breadth, dynamic interaction changes, and structural properties of the transaction network. Finally, five machine learning models—logistic regression, random forest, support vector machine, decision tree, and K-nearest neighbours—are used to identify vulnerabilities at different stages. Results show that vulnerable contracts exhibit distinct transaction features and ego network properties at different lifecycle stages.