Towards Detecting Comment-Code Inconsistency in Smart Contract via Pre-Training Techniques

Smart contracts are programs deployed on the blockchain. The security issues of smart contracts have become the focus in recent years. Comments have been widely used to improve the readability of programs. Nevertheless, comments and code are not always consistent in smart contracts because of the modification of developers based on token standards and code reuse. These inconsistencies can mislead developers and even pose security risks. We call comment-code inconsistencies as CCIs. In particular, permission-related CCIs can easily expose vulnerabilities in smart contracts, causing funds to be hacked. In this work, we employ pre-training techniques to detect CCIs on permission in smart contracts. Specifically, we collect 3511 comments from Ethereum and Defi projects. Firstly, we utilize BERT to classify permission comments. Then, we extract related function implementations of each permission comment using the compilation technique and adopt CodeT5 to embed comment-code pairs. Finally, we make use of BiLSTM to predict inconsistencies. The evaluation results show that our proposed approach performs better than the existing tools in both precision and recall. Moreover, considering the two stages, it achieves an accuracy of 95.2% and 91.5% in permission comment recognition and permission CCI detection, respectively.