GraphSA: Smart Contract Vulnerability Detection Combining Graph Neural Networks and Static Analysis

Abstract

Security incidents in smart contracts still occur frequently, as the underlying code is often vulnerable to attacks. However, traditional methods to detect vulnerabilities in smart contracts are limited by certain rigid rules, reducing accuracy and scalability. In this work, we propose GraphSA, which combines Graph neural networks (GNNs) and Static Analysis for smart contract vulnerability detection. First, we present the contract tree, which is obtained by converting the control flow graph (CFG) of a smart contract. Each node in the tree represents a crucial operation code (opcode) block, and each edge represents the control flow (execution order) between code blocks. Then, we propose an extended SAGConv and Topkpooling graph neural network (ST-GNN) to learn the features of each node in the tree. To enhance detection accuracy, we eliminate and merge some non-crucial nodes to highlight key nodes and execution orders. Finally, we evaluate our approach on 7,962 real-world smart contracts running on Ethereum and compare it with state-of-the-art approaches on six types of vulnerabilities. Experimental results show that our approach achieves higher detection accuracy than others.