# Smart Contract Vulnerability Detection Based on Hybrid Attention Mechanism Model
## 5 Experiments and Results
### Datasets and Processing  
In recent years, the Ethereum community has developed plenty of tools to analyze vulnerable smart contracts, but there is no standardized dataset. To collect enough data for our experiment, we use the SmartWild dataset collected by [PERSON] et al. [59] and a manually constructed dataset Sbcurated. This dataset comes from smart contracts that have been traded in the real world with a total number of 47518. These contracts have been repeatedly screened and have potential vulnerabilities, using the real Ethereum contract address as a unique identifier. Since there are many smart contract compiler versions, and some lower compiler versions are rarely run on Ethereum. In order to better simulate the current smart contract situation, this paper filters out some smart contracts with premature compiler versions when using the dataset, and finally adopts 24,957 smart contracts among them for experiments.  
The Sbcurated dataset consists of two parts, one of which is a real-world contract with vulnerabilities, and the other is a manually constructed contract with vulnerabilities. Smart contracts in this data set are manually marked with vulnerability locations and categories, which can be used to assess the effectiveness of smart contract analysis tools in identifying vulnerabilities. The dataset consists of 136 samples.  
The research [59] shows that the combination of Mythril and Slither is both accurate and efficient, so we apply them to initially label the SmartWild dataset. For contracts with inconsistent tool detection results, the Remix tool was used for further manual verification. First, this paper compiles and deploys the smart contract to be audited on Remix, then manually calls the function that may cause the vulnerability, and tests whether the execution of the function will trigger the vulnerability through the input of the constructor, and finally obtains the result of whether the smart contract is vulnerable. A vulnerable contract is labelled as \"1\" or else \"0\". Through the above operations, we can find that among the 24,957 smart contracts, 7851 contracts contain vulnerabilities. Among them, there were 1358 arithmetic overflow vulnerabilities, 1440 reentrancy vulnerabilities, 1927 timestamp dependency, 211 Unchecked Return Value and 1000 tx.origin. We randomly selected 80% of the samples as a training set, and the remaining 20% as the testing set, as shown in Table 2.  
For better experimental evaluation, we employ our proposed method exacting code fragments. A code fragment deals with multiple lines of code that contains key syntax and semantic information of the contract. Then we sift through each fragment and label the corresponding ground label as \"1\" (malicious) or \"0\" (benign). Furthermore, to focus on the key features of code fragments, we convert them into vector representations, which are acceptable to the deep learning models. First, we remove the non-ASCII character, blank lines, and comments. Then custom identifier of function is mapped as symbolic name such as \"FUN1\", \"FUN2\", and user-defined variables as \"VAR1\", \"VAR2\". At this time, we can get a dataset of code fragments.  
To obtain the vector representations that suitable for the input to models, we split each fragment into a set of tokens and choose Word2 Vector model to vectorize them. Deep learning models exploit different dimension of vectors for training. In this paper, we build six models as smart contract vulnerability detectors. And we will perform further evaluation based on them.