SCsVulSegLytix: Detecting and extracting vulnerable segments from smart contracts using weakly-supervised learning

Abstract

Smart contracts (SCs), self-executing digital contracts deployed on blockchain networks, are becoming increasingly more prevalent in various sectors, such as finance, thanks to their automation, transparency, and cost efficiency. Given the substantial size of assets managed by them, SCs have become attractive targets for hackers, who exploit vulnerabilities in them to steal funds. Blockchain’s inherent immutability means vulnerabilities cannot be fixed quickly, and the immaturity of the Solidity programming language, which introduces potential security threats to SCs, exacerbates this problem. As such, there is a pressing need to develop security measures to identify vulnerabilities in SCs. Non-learning-based detection methods utilizing heuristics designed by experts often cannot handle the evolving complexity of SC vulnerabilities. In contrast, though typically outperforming non-learning-based solutions, learning-based solutions generally do not pinpoint the locations of vulnerabilities in SCs. Learning-based approaches that identify the locations of vulnerabilities come with several challenges: First, they convert SCs into graphs, incurring computational overhead and making the learning system more complex. Second, most require line- or function-level labels to be trained, which are difficult to gather. Lastly, their coverage of vulnerability types is not extensive, exposing the user to vulnerabilities not covered by them. This work presents SCsVulSegLytix, a learning-based approach for detecting and extracting vulnerable segments in SCs. SCsVulSegLytix uses a source code-based Transformer model trained with contract-level labels to classify entire contracts as vulnerable, followed by a post-hoc interpretability method to extract vulnerable segments in SCs according to relevance scores. Unlike previous extraction models, SCsVulSegLytix requires no line-level annotations and can be trained using contract-wide labels only, which are much easier to collect. Moreover, it operates directly on Solidity source code, substantially improving efficiency compared to expensive graph-based models. Finally, it extends support to several important classes of SC vulnerabilities, meaning developers are protected against various potential attacks. Experiments show that our model outperforms existing models concerning both contract- and line-level vulnerability identification while achieving greater computation efficiency.