Machine Learning–Based Vulnerability Detection in Ethereum Smart Contracts via EVM Bytecode Feature Engineering

Abstract

<b>Abstract.</b>Smart contract vulnerabilities have led to losses exceeding billions of US dollars in the decentralised finance (DeFi) ecosystem. Existing detection tools based on symbolic execution and static analysis, while precise, are computationally expensive and often impractical for large-scale screening. In this work, we propose a lightweight machine learning approach that operates directly on compiled EVM bytecode, requiring neither source code nor contract ABI. We design a feature engineering pipeline that extracts 65 security-oriented numerical features from disassembled bytecode instructions, covering reentrancy patterns, arithmetic overflow indicators, gas-based denial-of-service risks, access control anomalies, and environmental dependencies. Using a dataset of 117,091 real-world Ethereum smart contracts labelled by the Slither static analyser, we evaluate four classifiers—Logistic Regression, Decision Tree, Random Forest, and XGBoost—under stratified 5-fold cross-validation. XGBoost, optimised via Bayesian hyperparameter search (Optuna, 50 trials), achieves an F1-score of 0.947 on cross-validation and 93% accuracy on a held-out validation set, with 0.97 recall for vulnerable contracts and 0.85 recall for safe contracts. We additionally benchmark text-based opcode sequence representations and find that hand-crafted numerical features substantially outperform n-gram vectorisation approaches.<br>Code and materials (GitHub): https://github.com/SergeySolovyev/Machine-Learning-Based-Vulnerability-DetectionDate: 26 Feb 2026. Version: v1.