Year: 2025
Type: article
Abstract: The detection of vulnerabilities in smart contracts remains a significant challenge. While numerous tools are available for analyzing smart contracts in source code, only about 1.79% of smart contracts on Ethereum are open-source. For existing tools that target bytecodes, most of them only consider the semantic logic context and disregard function interface information in the bytecodes. In this paper, we proposeCOBRA, a novel framework that integrates semantic context and function interfaces to detect vulnerabilities in bytecodes of the smart contract. To our best knowledge,COBRAis the first framework that combines these two features. Moreover, to infer the function signatures that are not present in signature databases, we proposeSRIF, automatically learn the rules of function signatures from the smart contract bytecodes. The bytecodes associated with the function signatures are collected by constructing a control flow graph (CFG) for theSRIFtraining. We optimize the semantic context using the operation code in the static single assignment (SSA) format. Finally, we integrate the context and function interface representations in the latent space as the contract feature embedding. The contract features in the hidden space are decoded for vulnerability classifications with a decoder and attention module. Experimental results demonstrate thatSRIFcan achieve 94.76% F1-score for function signature inference. Furthermore, when the ground truth ABI exists,COBRAachieves 93.45% F1-score for vulnerability classification. In the absence of ABI, the inferred function feature fills the encoder, and the system accomplishes an 89.46% recall rate.
Authors: Wenkai Li, Xiaoqi Li, Yingjie Mao, Yuqing Zhang
Institutions: Hainan University, University of Chinese Academy of Sciences
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
Awards: G4955479608, G969737726
OpenAlex ID: W4413966867