一句话：提出深度学习工具，用控制流图与调用图构建异构图注意力网络，在合约级和行级检测智能合约漏洞。
智能合约部署后难以修改，需在部署前保证源码质量，但现有漏洞检测常难以兼顾合约级与行级精度。本文提出 MANDO-GURU，针对 Solidity 源码，结合控制流图与调用图构建异构图，设计异构图注意力神经网络编码节点与边之间的结构和语义关系，并利用图及节点嵌入分别进行合约级和行级漏洞检测。真实智能合约数据集评估表明，该工具在合约级按漏洞类型可将 F1 分数较多种方法提升最高 24%，并首次实现以太坊智能合约行级学习式漏洞检测，较传统代码分析技术提升最高 63.4%。工具已开源并提供在线测试版。
Smart contracts are increasingly used with blockchain systems for high-value applications. It is highly desired to ensure the quality of smart contract source code before they are deployed. This paper proposes a new deep learning-based tool, MANDO-GURU, that aims to accurately detect vulnerabilities in smart contracts at both coarse-grained contract-level and fine-grained line-level. Using a combination of control-flow graphs and call graphs of Solidity code, we design new heterogeneous graph attention neural networks to encode more structural and potentially semantic relations among different types of nodes and edges of such graphs and use the encoded embeddings of the graphs and nodes to detect vulnerabilities. Our validation of real-world smart contract datasets shows that MANDO-GURU can significantly improve many other vulnerability detection techniques by up to 24% in terms of the F1-score at the contract level, depending on vulnerability types. It is the first learning-based tool for Ethereum smart contracts that identify vulnerabilities at the line level and significantly improves the traditional code analysis-based techniques by up to 63.4%. Our tool is publicly available at https://github.com/MANDO-Project/ge-sc-machine. A test version is currently deployed at http://mandoguru.com, and a demo video of our tool is available at http://mandoguru.com/demo-video.
@inproceedings{paperbot7032,
title = {MANDO-GURU: vulnerability detection for smart contract source code by heterogeneous graph embeddings},
author = {Hoang H. Nguyen and Nhat-Minh Nguyen and Hong-Phuc Doan and Zahra Ahmadi and Thanh-Nam Doan and Lingxiao Jiang},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3558927}
}