一句话：提出 SCVHunter 框架，用异构语义图与异构图注意力网络检测智能合约漏洞，并支持专家标注关键节点。
智能合约是区块链发展的关键，但其漏洞构成严重威胁。传统漏洞检测方法高度依赖专家定义的复杂规则，劳动密集且难以适应智能合约的爆炸式增长；近期基于神经网络的检测方法也仍有改进空间。为此，本文提出 SCVHunter——一个可扩展的智能合约漏洞检测框架。该方法首先基于中间表示设计异构语义图构建阶段，随后采用面向智能合约的异构图注意力网络进行漏洞检测阶段；特别地，SCVHunter 允许用户自由指出图中更重要的节点，从而以更简便的方式利用专家知识，辅助模型自动捕获更多与漏洞相关的信息。作者在重入、区块信息依赖、嵌套调用和交易状态依赖四类漏洞上进行了测试，准确率分别达到 93.72%、91.07%、85.41% 和 87.37%，优于此前的方法。
Smart contracts are integral to blockchain's growth, but their vulnerabilities pose a significant threat. Traditional vulnerability detection methods rely heavily on expert-defined complex rules that are labor-intensive and dificult to adapt to the explosive expansion of smart contracts. Some recent studies of neural network-based vulnerability detection also have room for improvement. Therefore, we propose SCVHunter, an extensible framework for smart contract vulnerability detection. Specifically, SCVHunter designs a heterogeneous semantic graph construction phase based on intermediate representations and a vulnerability detection phase based on a heterogeneous graph attention network for smart contracts. In particular, SCVHunter allows users to freely point out more important nodes in the graph, leveraging expert knowledge in a simpler way to aid the automatic capture of more information related to vulnerabilities. We tested SCVHunter on reentrancy, block info dependency, nested call, and transaction state dependency vulnerabilities. Results show remarkable performance, with accuracies of 93.72%, 91.07%, 85.41%, and 87.37% for these vulnerabilities, surpassing previous methods.
@inproceedings{paperbot11306,
title = {SCVHunter: Smart Contract Vulnerability Detection Based on Heterogeneous Graph Attention Network},
author = {Feng Luo and Ruijie Luo and Ting Chen and Ao Qiao and Zheyuan He and Shuwei Song and Yu Jiang and Sixing Li},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639213}
}