ContractScanner: Detecting and Localizing Vulnerabilities of Smart Contracts via Graph-Based Semantic Modeling of Source Code

Abstract

Smart contract vulnerabilities pose persistent threats to decentralized applications, causing substantial financial losses across the Web 3.0 ecosystem. Although recent deep learning-based detectors improve scalability, they face two key limitations: (i) limited semantic fidelity because bytecode- or sequence-level representations fail to capture contextual dependencies; and (ii) inadequate vulnerability localization, as most approaches are confined to contract-level classification, limiting their audit utility. To address these challenges, we present ContractScanner for joint vulnerability detection and fine-grained localization directly from the source code. First, we propose an anchor-aware semantic slicing method to filter contracts into vulnerability-relevant regions by matching structural anchor patterns and preserving contextual dependencies. Second, we transform these slices into heterogeneous program graphs that encode control, data, and syntactic flows.We then apply a dual-stage reasoning pipeline. A Graph Isomorphism Network (GIN) extracts global structural features for contract-level classification, while a Graph Autoencoder (GAE) reconstructs fine-grained topological patterns to localize vulnerability-critical code regions. Third, to address data scarcity, we introduce anchor-guided G-Mixup, which generates augmented training samples by interpolating feature embeddings of contract slices with similar vulnerability semantics. We evaluate ContractScanner on two real-world benchmarks spanning five major vulnerability types—reentrancy, integer overflow/underflow, timestamp dependency, and callstack depth exhaustion. Our method achieves an average F1-score of 94.74%, significantly outperforming symbolic analyzers, classical learning models, and prior graph-based methods.