Smart Learning to Find Dumb Contracts (Extended Version)

• Main Authors: Abdelaziz, Tamer, Hobor, Aquinas
• Format: Journal Article
• Language: English
• Published: 20-04-2023
• Subjects: Computer Science - Cryptography and Security; Computer Science - Learning; Computer Science - Software Engineering
• DOI: 10.48550/arxiv.2304.10726

32nd USENIX Security Symposium 2023 We introduce the Deep Learning Vulnerability Analyzer (DLVA) for Ethereum
smart contracts based on neural networks. We train DLVA to judge bytecode even
though the supervising oracle can only judge source. DLVA's training algorithm
is general: we extend a source code analysis to bytecode without any manual
feature engineering, predefined patterns, or expert rules. DLVA's training
algorithm is also robust: it overcame a 1.25% error rate mislabeled contracts,
and--the student surpassing the teacher--found vulnerable contracts that
Slither mislabeled. DLVA is much faster than other smart contract vulnerability
detectors: DLVA checks contracts for 29 vulnerabilities in 0.2 seconds, a
10-1,000x speedup. DLVA has three key components. First, Smart Contract to
Vector (SC2V) uses neural networks to map smart contract bytecode to a
high-dimensional floating-point vector. We benchmark SC2V against 4
state-of-the-art graph neural networks and show that it improves model
differentiation by 2.2%. Second, Sibling Detector (SD) classifies contracts
when a target contract's vector is Euclidian-close to a labeled contract's
vector in a training set; although only able to judge 55.7% of the contracts in
our test set, it has a Slither-predictive accuracy of 97.4% with a false
positive rate of only 0.1%. Third, Core Classifier (CC) uses neural networks to
infer vulnerable contracts regardless of vector distance. We benchmark DLVA's
CC with 10 ML techniques and show that the CC improves accuracy by 11.3%.
Overall, DLVA predicts Slither's labels with an overall accuracy of 92.7% and
associated false positive rate of 7.2%. Lastly, we benchmark DLVA against nine
well-known smart contract analysis tools. Despite using much less analysis
time, DLVA completed every query, leading the pack with an average accuracy of
99.7%, pleasingly balancing high true positive rates with low false positive
rates.