Smart contract technology facilitates self-executing agreements on the blockchain, eliminating dependency on an external trusted authority. However, smart contracts may expose vulnerabilities that can lead to financial losses and disruptions in decentralized applications. In this work, we evaluate deep learning-based approaches for vulnerability scanning of Ethereum smart contracts. We propose VASCOT, a Vulnerability Analyzer for Smart COntracts using Transformers, which performs sequential analysis of Ethereum Virtual Machine (EVM) bytecode and incorporates a sliding window mechanism to overcome input length constraints. To assess VASCOT's detection efficacy, we construct a dataset of 16,469 verified Ethereum contracts deployed in 2022, and annotate it using trace analysis with concrete validation to mitigate false positives. VASCOT's performance is then compared against a state-of-the-art LSTM-based vulnerability detection model on both our dataset and an older public dataset. Our findings highlight the strengths and limitations of each model, providing insights into their detection capabilities and generalizability.

翻译：智能合约技术促进了区块链上自执行协议的实施，消除了对外部可信机构的依赖。然而，智能合约可能暴露漏洞，导致去中心化应用中的财务损失和运行中断。本研究评估了基于深度学习的以太坊智能合约漏洞扫描方法。我们提出了VASCOT，一种基于Transformer的智能合约漏洞分析器，该工具对以太坊虚拟机字节码进行序列分析，并引入滑动窗口机制以克服输入长度限制。为评估VASCOT的检测效能，我们构建了包含16,469个2022年部署的已验证以太坊合约的数据集，并通过结合具体验证的轨迹分析方法进行标注以降低误报率。随后在自建数据集和旧有公共数据集上，将VASCOT的性能与最先进的基于LSTM的漏洞检测模型进行对比。研究结果揭示了两种模型的优势与局限，为理解其检测能力和泛化性提供了新的见解。