Reuse Consistency Crisis: Demystifying EVM-Inequivalent Code Smells in Multi-chain Reuse Contracts

EquivSage Artifact This repository contains the introduction of the EquivSage Tool, Experimental Data, and Datasets. EquivSage_tool The EquivSage_tool directory includes the source code and relevant documentation for the EquivSage tool. It contains the following contents: * README.md: Documentation on how to install and use EquivSage. * Source Code: The source code for the tool. * Examples: Contains smart contract files for testing. Experimental_data The experimental data mainly includes our empirical study data (used to define the code smells) and the experimental data for RQ1, RQ2, RQ3, and RQ4. * RQ1: How does EquivSage perform on real large-scale datasets? Includes detection results on a dataset of 1,263,683 contract source codes. Covers nine detected types of EVM-Inequivalent Code Smells: Cross-Chain Replay Attack (CCRA), Time Discrepancy Trap (TDT), Fixed Gas Reentrancy (FGR), Block Height Misalignment (BHM), Phishing Contract Address (PCA), Gas Limit Imbalance (GLI), Broken msg.sender == tx.origin Assumption (BMTA), Inconsistent Opcodes Implementation (IOI), and Inconsistent Precompile Implementation (IPI). * RQ2: What is the performance of EquivSage in detecting EVM-Inequivalent Code Smells? Includes sampled data from EquivSage's large-scale detection results (738 positive, 97 negative cases), which were manually analyzed to assess Precision (97.70%) and Recall (98.77%). * RQ3: What is the impact of different phases within EquivSage? Contains the ablation experiment results comparing four configurations (Full Setup, No LLM Assistance, No Symbolic Execution, Neither) on the labeled dataset (730 TPs, 105 TNs). * RQ4: What is the prevalence and distribution of EVM-Inequivalent Code Smells in real-world multi-chain reused contracts? Contains the analysis of 2,259 multi-chain reused contracts identified from 69,451 Ethereum contracts containing smells. Includes statistics on distribution by type, deployment date, and economic impact. Empirical_Study_Data Security_audit: Includes 1,379 open-source audit reports collected from 30 security teams. Bug_bounty_reports: Includes 823 reports from platforms like Code4Rena, Immunefi, Sherlock, and CodeHawks. Stackoverflow_posts: Includes 326 relevant Stack Overflow posts filtered using tags such as "EVM", "EVM Equivalent", and "EVM Compatible". Datasets We used a large-scale, open-source dataset of 1,263,683 real-world smart contract source codes. This dataset was collected from six mainstream EVM-compatible blockchains (Ethereum, Binance Smart Chain, Arbitrum, Polygon, Optimism, and Avalanche) and covers deployments through July 2025. To our knowledge, this represents the largest publicly available dataset of smart contracts across these six chains.