# Toward Vulnerability Detection for Ethereum Smart Contracts Using Graph-Matching Network
###### Abstract
For example, fuzzing, an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program, is used to explore the state space of smart contract executions and thus detect deep vulnerabilities [11; 12; 13; 14]. Symbolic execution, another software-testing technique that executes programs with symbolic inputs instead of concrete ones, is also applied to find vulnerabilities for smart contracts [15; 16; 17; 18; 19]. Both fuzzing and symbolic execution need smart contracts to be actually executed, which requires certain testing environments. In contrast to them, formal verification establishes mathematical models to determine the correctness of software behaviors before deployment. Owing to the usually small code size of smart contracts, formal verification methods are quite applicable to this scenario and thus are attracting growing attention from both academic fields and Solidity language committees [20; 21; 22; 23]. Static analysis is another debugging method that examines the code without having to execute it. Program features or intermediate representations are extracted from smart contracts for vulnerability detection [24; 25; 26; 27]. Among the above approaches, static analysis is considered a competitive and practical way to detect vulnerabilities in smart contracts since it does not necessitate actual code execution or complex formal specifications. However, learning more directional vulnerability features is a key factor to determine the effectiveness of static analysis tools. Most existing methods prefer to utilize abstract features and violation patterns to identify vulnerabilities [24; 25; 26; 27], without taking full advantage of syntactic information and code structures. In this paper, we build a graph representation of smart contracts, i.e., abstract semantic graph (ASG), based on a set of existing graph representations, such as abstract syntax tree (AST), control flow graph (CFG), and data flow graph (DFG). The basic idea of ASG is to mix up the above multi-views together into one single view such that more syntactic and semantic information can be preserved. In order to detect vulnerabilities of smart contracts in forms of both source code and bytecode, we propose two novel approaches called _ASGVulDetector_ and _BASGVulDetector_ through calculating the similarity between the code under test and the known vulnerable code via the graph matching network (GMN). Our approaches generally consist of three steps: Firstly, smart contracts are transformed to graph representations. Secondly, graph embedding is conducted to calculate vector representations for these contracts. Thirdly, similarities of each code pairs are measured through GMN. To fully utilize the abstract code structures, we construct an ASG by enriching the AST with control flow and data flow when the source code is available, while the ASG of a smart contract in bytecode is extracted by decompiling and enriching basic block sequences with control flow. Based on that, we apply two training models, i.e., graph neural network (GNN) and GMN, on ASG to investigate the impact of different models. To validate the effectiveness of the proposed approaches, we conduct extensive experiments on a dataset of smart contracts, as well as comparing them with competitive vulnerability detection tools. The main contributions of this paper are summarized as follows. * We design a novel graph representation ASG for smart contracts in forms of source code and bytecode, which takes advantage of both syntactic information and code structural features. * We apply a graph-matching network model based on the ASG representation for vulnerability detection in smart contracts. We adopt two different training models, i.e., GNN and GMN, to analyze the difference between their performance.