A smart contract, as an important part of blockchain technology, has attracted considerable interest from both industry and academia. It provides the basis for the realization of a variety of practical blockchain applications and plays a crucial role in the blockchain ecosystem. While it also holds a large number of digital assets, the frequent occurrence of smart contract vulnerabilities have caused huge economic losses and destroyed the blockchain-based credit system. Currently, the security and reliability of smart contracts have become a new focus of research, and there are a number of smart contract vulnerability detection methods, such as traditional detection tools based on static or dynamic analysis. However, most of them often rely on expert rules, and therefore have poor scalability and high false negative and false positive rates. Recent deep learning methods alleviate this issue, but without considering the semantic information and context of source code. To this end, we propose a hybrid attention mechanism (HAM) model to detect security vulnerabilities in smart contracts. We extract code fragments from the source code, which focus on key points of vulnerability. We conduct extensive experiments on two public smart contract datasets (a total of 24,957 contracts). Empirical results show remarkable accuracy improvement over the state-of-the art methods on five kinds of vulnerabilities, where the detection accuracy could achieve 93.36%, 80.85%, 82.56%, 85.62%, and 82.19% for reentrancy, arithmetic vulnerability, unchecked return value, timestamp dependency, and tx.origin, respectively.

The correctness verification is very important for workflow systems. It is closely related with both control-flows and data-flows. Workflow nets with data (WFD-nets) are a kind of formal model that can reflect some logical structures of workflow systems, e.g., choice and concurrency, and represent some operations on data, e.g., read, write, and delete. However, these data operations are conceptual in WFD-nets and only characterize the logical relation between two operations, e.g., whether a write and a read are concurrently operating on a data. They do not consider the functional requirements about data (i.e., data constraints). Thus, some data errors cannot be found via WFD-nets. In order to solve this problem, we propose Workflow nets with Data Constraints (WFDC-nets) and define four levels of soundness to describe different correctness requirements. Based on the reachability graphs of WFDC-nets, we verify the soundness. The related algorithms are proposed and a tool is developed to show the effectiveness and usefulness of our method.

In recent years, the number of smart contracts deployed on blockchain has exploded. However, the issue of vulnerability has caused incalculable losses. Due to the irreversible and immutability of smart contracts, vulnerability detection has become particularly important. With the popular use of neural network model, there has been a growing utilization of deep learning-based methods and tools for the identification of vulnerabilities within smart contracts. This paper commences by providing a succinct overview of prevalent categories of vulnerabilities found in smart contracts. Subsequently, it categorizes and presents an overview of contemporary deep learning-based tools developed for smart contract detection. These tools are categorized based on their open-source status, the data format and the type of feature extraction they employ. Then we conduct a comprehensive comparative analysis of these tools, selecting representative tools for experimental validation and comparing them with traditional tools in terms of detection coverage and accuracy. Finally, Based on the insights gained from the experimental results and the current state of research in the field of smart contract vulnerability detection tools, we suppose to provide a reference standard for developers of contract vulnerability detection tools. Meanwhile, forward-looking research directions are also proposed for deep learning-based smart contract vulnerability detection.

Ensuring the absence of vulnerabilities or flaws in smart contracts before their deployment is crucial for the smooth progress of subsequent work. Existing detection methods heavily rely on expert rules, resulting in low robustness and accuracy. Therefore, we propose EDSCVD, an enhanced deep learning vulnerability detection model based on dual-channel networks. Firstly, the contract fragments are preprocessed by BERT into the required word embeddings. Next, we utilized adversarial training FGM to the word embeddings to generate perturbations, thereby producing symmetric adversarial samples and enhancing the robustness of the model. Then, the dual-channel model combining BiLSTM and CNN is utilized for feature training to obtain more comprehensive and symmetric information on temporal and local contract features.Finally, the combined output features are passed through a classifier to classify and detect contract vulnerabilities. Experimental results show that our EDSCVD exhibits excellent detection performance in the detection of classical reentrancy vulnerabilities, timestamp dependencies, and integer overflow vulnerabilities.

The identification of vulnerabilities in smart contracts is necessary for ensuring their security. As a pre-trained language model, BERT has been employed in the detection of smart contract vulnerabilities, exhibiting high accuracy in tasks. However, it has certain limitations. Existing methods solely depend on features extracted from the final layer, thereby disregarding the potential contribution of features from other layers. To address these issues, this paper proposes a novel method, which is named multi-layer feature fusion (MULF). Experiments investigate the impact of utilizing features from other layers on performance improvement. To the best of our knowledge, this is the first instance of multi-layer feature sequence fusion in the field of smart contract vulnerability detection. Furthermore, there is a special type of patched contract code that contains vulnerability features which need to be studied. Therefore, to overcome the challenges posed by limited smart contract vulnerability datasets and high false positive rates, we introduce a data augmentation technique that incorporates function feature screening with those special smart contracts into the training set. To date, this method has not been reported in the literature. The experimental results demonstrate that the MULF model significantly enhances the performance of smart contract vulnerability identification compared to other models. The MULF model achieved accuracies of 98.95% for reentrancy vulnerabilities, 96.27% for timestamp dependency vulnerabilities, and 87.40% for overflow vulnerabilities, which are significantly higher than those achieved by existing methods.

Data has a great influence on the analysis of the correctness of workflow systems. How to ensure that a system runs without data errors is very important. Workflow nets with data constraints (WFDC-nets) are a kind formal model that is good at specifying data oriented functional requirements in workflow systems. A sound WFDC-net can guarantee that the system is not only functionally correct but also meets all data requirements. Methods and tools for the soundness verification of WFDC-nets have been designed. However, how to locate unsound transitions in a WFDC-net and then effectively control them is still an open topic. This paper attempts to solve the issue and gives methods to optimize unsound workflow systems in design stage. In our solution, we first construct a minimal complete configuration tree (MCC-tree) based on the configuration graph with data constraints (C-graph) of the WFDC-net, and then we define four kinds of paths and algorithms to characterize unsound transitions. Furthermore, a pseudo intermediate set (PIS) is constructed according to different paths and unsound transitions. Based on it, a 4-step controlling strategy is taken to optimize the system and finally makes the controlled system satisfy the data requirements. An e-commerce system is used to illustrate the feasibility and effectiveness of the proposed methods.