Accelerating Smart Contract Vulnerability Scan Using Transformers

Abstract

Ethereum technology has brought upon the smart contract concept, enabling multiple independent parties to engage in transactions without the need for an external trusted authority. While this distributed network operates correctly and autonomously, smart contracts may expose security vulnerabilities, which may be exploited by malicious actors to illegitimately transfer funds. Furthermore, once a smart contract is created, it cannot be changed due to the immutability of the blockchain structure. Hence, it is critical to detect smart contract vulnerabilities before they are deployed. In this work, we propose VASCOT, a Vulnerability Analyzer for Smart COntracts using Transformers, to automatically perform sequential analysis on the EVM bytecode of smart contracts, to detect trace vulnerabilities. We construct a data set comprising Ethereum smart contracts verified in 2022; our evaluation of VASCOT on this data set demonstrates improvement in accuracy and significant reduction in time cost compared to the previously proposed sequential vulnerability scanners. To the best of our knowledge, this work constitutes the first use of transformers for smart contract security.