Privacy-preserving vulnerability detection scheme for smart contracts

Abstract

Smart contracts are automated agreements encoded in the form of code, enabling functionalities such as automated asset transfers and digital asset issuance. These contracts eliminate the need for third-party trust verification, thereby reducing transactional intermediates and costs. Due to their irrevocability and non-breachability, smart contracts execute automatically once preset conditions are met, without the possibility of revocation or modification. However, these characteristics can be exploited by malicious individuals seeking illegitimate gains through vulnerabilities in the contracts. Existing smart contract vulnerability detection tools primarily rely on expert-defined rules, leading to a high false alarm rate and a tedious detection process. Nevertheless, smart contract owners often withhold open-sourcing their contracts due to privacy concerns. This reluctance results in issues like insufficient data and incomplete training samples for deep learning models during the training phase. Consequently, the trained models suffer from limited detection scope and inadequate precision. We compare our approach with existing deep learning methods for detecting vulnerabilities in smart contracts: BiLSTM+Attention. To address these challenges, this paper introduces a federated learning-based approach for detecting vulnerabilities in smart contracts. This method leverages Federated Learning and the BERT model for smart contract vulnerability detection. Significantly, enterprises involved in this approach are not required to provide source code; instead, they participate in federated learning by contributing gradient data. The BERT model is then trained on this gradient dataset. Experimental results demonstrate that the proposed method achieves a remarkable 91.36% accuracy in vulnerability detection.