# Smart Contract Vulnerability Detection Based on Hybrid Attention Mechanism Model
###### Abstract
They always explore and exploit the possible vulnerabilities in smart contracts to steal funds or hinder the normal operation of the blockchain network. Further, as the number of smart contracts explodes, it is increasingly important to check potential vulnerabilities of smart contracts more accurately and efficiently, before they are deployed. **Disadvantages of traditional approaches**. From the perspective of whether to execute the program, traditional methods on finding vulnerabilities mainly can be divided into two categories, namely static analysis [21; 22; 23] and dynamic execution technology [24; 25]. Although they have achieved good results, but they still have some problems. First, the existing methods rely heavily on hard rules (or patterns) defined by human experts. As the number of smart contracts increases rapidly, it is unrealistic to expect that a few experts can audit all the contracts and design the corresponding rules or patterns. What is more, expert rules are not always reliable, and some complex patterns are difficult to consider. More recently, efforts have been made towards applying deep learning-driven techniques to vulnerability detection of smart contract. With its powerful feature mining ability, deep learning technology can extract implied features from the data itself and has extremely high universality. [PERSON] et al. [26] introduces an LSTM model to detect smart contract security threats at an opcode level. [PERSON] et al. [27] proposes a sequential model to focus on the reentrancy vulnerability, while [PERSON] et al. [28] build the control flow graph to represent a smart contract function. However, they methods still have some shortcomings. They just regard the source code or opcode code as a text sequence, and ignore the key variables of data flow. This can lead to inadequate semantic modeling and unsatisfactory vulnerability prediction results. To address this issue, we introduce a method of source code vulnerability detection based on the hybrid attention mechanism (HAM) model, which consists of consists of a single-head attention encoder combined with a bidirectional gated recurrent unit (Bi-GRU) and a multi-head attention encoder. Specially, we extract code fragments with key points of vulnerability from smart contact to improve the performance of deep learning models. Then the generated code fragments are converted into fixed-dimension vector. Next, the vector is fed into a hybrid attention mechanism network for feature learning. Finally, the single-headattention features and the multi-head features are incorporated to produce the final vulnerability detection results. We conducted experiments on two public real datasets, which contains five types of vulnerabilities (i.e., reentrancy, timestamp dependency, unchecked return value, and arithmetic vulnerability). In summary, the main contributions of this work are as follows:  
* To our knowledge, we are the first to present the idea of fusing the single-head feature and the multi-head attention feature for smart contract vulnerability detection. * We propose to extract code fragments with richer data flow and control flow information, which obviously enhance the detection performance of deep learning models. * We compare our model with other ten state-of-the-art method and the comparison results show that our model performs best in the detection of five types (reentrancy, timestamp dependency, unchecked return value, tx.origin, and arithmetic vulnerability) of smart contract vulnerabilities. The rest of the paper is organized as follows. Section 2 introduces some background of Ethereum and smart contract, five types of vulnerabilities we aim to detect, and the motivation of our approach. Section 3 describes the related work about the vulnerability detection of smart contract. Section 4 presents the approach details. In Section 5, we show the experimental results. Section 6 concludes the paper.