# Toward Vulnerability Detection for Ethereum Smart Contracts Using Graph-Matching Network
## 3 Related Work  
Extensive studies have been focused on vulnerability detection in smart contracts. According to the software-testing technique used to reach the goals, existing approaches can be classified into four categories: fuzzing, symbolic execution, formal verification, and static analysis. Fuzzing is an automated software testing technique that feeds the program under test with a large volume of random inputs to identify code errors and security vulnerabilities from black, grey or white box perspectives. [PERSON] et al. [11] proposed the first fuzzing framework called _ContractFuzzer_ for detecting security vulnerabilities in smart contracts on the Ethereum platform. _ContractFuzzer_ generates fuzzing inputs according to the ABI specifications of smart contracts, and instruments EVM to provide feedback during the execution. However, _ContractFuzzer_ only supports a custom set of built-in detectors. In contrast to that, [PERSON] et al. [12] implemented another Ethereum smart contract fuzzer called _Echidna_, which supports a large set of features based on experience with security audits, such as custom property checking, assertion checking, and estimation of maximum gas usage. Inspired by the well-known fuzzer for C programs, i.e., AFL, [PERSON] et al. [14] proposed an adaptive fuzzer called _sFuzz_ for Ethereum smart contracts. It combines the strategy in AFL and a lightweight multi-objective adaptive strategy targeting those hard-to-reach branches. To explore more transition states and thereby detect deep vulnerabilities, [PERSON] et al. [13] designed a greybox fuzzer for smart contracts called _Harvey_, which is equipped with two key techniques, i.e., input prediction and demand-driven sequence fuzzing. Symbolic execution is a way of executing a program abstractly so that one abstract execution covers multiple possible inputs that share the same program path. It has been widely used to explore the program states and detect security vulnerabilities for smart contracts. [PERSON] et al. [15] built a symbolic execution tool called _Oyente_ for Ethereum smart contracts, which takes bytecodes as input and consists of four main components to perform CFG construction, symbolic execution, constraint solving, and false alarm filtering. On the basis of _Oyente_, [PERSON] et al. [16] proposed a symbolic execution framework combined with taint analysis called _Osiris_, focusing on accurately detecting integer vulnerabilities in smart contracts of the Ethereum platform. [PERSON] et al. [17] implemented a dynamic symbolic execution framework called _Manticore_ for analyzing binaries of Ethereum smart contracts. Its flexible architecture allows performing symbolic execution on alternative platforms. To effectively find vulnerable transaction sequences in smart contracts, [PERSON] et al. [18] presented a symbolic execution technique called _Smartest_, which utilizes statistical language models to guide symbolic execution so that it can effectively prioritize program paths that are likely to reveal vulnerabilities. In view of the fact that most smart contract symbolic execution tools perform analysis on bytecode, [PERSON] et al. [19] designed a source-level symbolicexecution for Ethereum smart contracts, which can take advantage of high-level semantic information in the source code. Formal verification conducts mathematical analysis to prove or disprove the correctness of a program by checking its formal model against a certain formal specification. [PERSON] et al. [21] presented a formal verification tool called _Securify_ to detect vulnerabilities in smart contracts. It is integrated with compliance and violation patterns described in domain-specific language to examine whether there are loopholes in the contracts. [PERSON] et al. [20] established the formal model of smart contracts and utilized model checking to verify the correctness as well as important properties of the contracts. [PERSON] et al.