ContractGNN: Ethereum Smart Contract Vulnerability Detection Based on Vulnerability Sub-Graphs and Graph Neural Networks

Smart contracts have been widely used for their capability of giving blockchain a user-defined logic. In recent years, several smart contract security incidents have resulted in enormous financial losses. Therefore, it is important to detect vulnerabilities in smart contracts before deployment. Machine learning has been used recently in smart contract vulnerability detection. Unfortunately, due to the loss of information during feature extraction, the detection results are unsatisfactory. Hence, we propose a novel approach called ContractGNN, which combines a new concept of a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">vulnerability sub-graph</i> (VSG) with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">graph neural networks</i> (GNNs). Compared with traditional methods, checking a VSG is more accurate because the VSG removes irrelevant vertexes in the control flow graph. Furthermore, a VSG can be aggregated and simplified, thus improving the efficiency of message passing in a GNN. Based on aggregated VSGs, we design a new feature extraction method that preserves semantic information, the order of opcode, and control flows of smart contracts. Moreover, we compare a large number of GNN classification models and select the best one to implement ContractGNN. We then test ContractGNN on 48,493 real-world smart contracts, and the experimental results show that ContractGNN outperforms other smart contract vulnerability detection tools, with an average F1 score of 89.70%.