Ecosystem Analysis of Web3 Smart Contract Vulnerability Classification and Management

Abstract

Smart contracts manage high-value digital assets, making their security a critical priority. In this work, we present a preliminary ecosystem analysis of how smart contract vulnerabilities are currently classified, disclosed, and managed across academia and industry. Our findings reveal the fragmented nature of Web3 security, characterized by a history of attempted classification schemes and a lack of proper vulnerability disclosure. We propose several hypotheses for this divergence from traditional software standards, including ideological decentralization, reputation management, and misaligned financial incentives. A case study of Uniswap illustrates these challenges, revealing inconsistent reporting and the difficulty of verifying vulnerability data. Ultimately, this work serves as a foundational step toward establishing unified methodologies for the detection, management, and disclosure of smart contract vulnerabilities.