# Toward Vulnerability Detection for Ethereum Smart Contracts Using Graph-Matching Network
## 3 Related Work
[22] proposed a formal verification tool called _SAFEVM_, which consists in decompiling the Ethereum bytecode into a C program with ERROR annotations so that existing verification engines developed for C programs can be used to verify these bytecodes. [PERSON] et al. [23] designed a bounded model checker for Solidity called _Solidifer_, which leverages Boogie, an intermediate verification language, to capture accurate semantics of Solidity's memory model, lazy contract deployment and memory precise verification harness. Static analysis is a method of computer program debugging by examining the source code without executing the program, which can guarantee full code coverage and fast detection efficiency. [PERSON] et al. [24] proposed an extensible static analysis tool called _SmartCheck_ for Ethereum smart contracts, which converts Solidity code into XML-based intermediate representation and checks it against XPath patterns derived from vulnerable behaviors. Similarly, [PERSON] et al. [25] represented another static analysis tool called _Slither_, which translates Solidity code into a user-defined intermediate representation called SlitherIR. Moreover, it combines data flow and taint analysis techniques to extract more semantic information and detect pattern violations. [PERSON] et al. [26] summarized existing strategies to avoid reentrancy vulnerability as path protection techniques (PPTs), and proposed a static analysis tool called _Claircoyance_ for reentrancy bug detection. It relies on a cross-contract inter-procedural CFG (ICFG) representation and PPT patterns to identify potential paths that contain reentrancy. As the most similar work to our approaches, [PERSON] et al. [27] constructed a contract graph to represent both syntactic and semantic structures of a smart contract function. Based on that, the graph neural network and temporal message propagation network are separately introduced as the training models for vulnerability detection. However, the graph defined in this work involves three types of nodes with complex edge information, which can fail to generalize across different contracts. Although the above studies provide promising approaches for vulnerability detection in smart contracts, there still remain limitations and challenges. In general, fuzzing and symbolic execution have to execute the smart contracts, either concretely or symbolically, which require sandboxed environments and have execution overhead. Formal verification-based techniques are limited by the rarely available formal specification of built-in functions. Static analysis is an effective way to find bugs, but usually relies on the accuracy of an intermediate representation to feature the code. Furthermore, patterns or models for detecting bugs are of key importance to the performance of vulnerability detection. Most existing static analysis methods require source code to perform vulnerability detection. In this paper, we attempt to address these issues through a novel graph representation for both source code and bytecode, coupled with the graph-matching network technique.