A Triplet-Learning-Based Framework for Cross-Version Smart Contract Vulnerability Detection

Abstract

As security concerns in blockchain platforms continue to rise, triggered by substantial financial losses, detecting vulnerabilities in smart contracts has emerged as a crucial focus for both academia and industry. Although many promising vulnerability detection methods for Ethereum have been proposed in recent years, their long-term reliability and adaptability across different versions of smart contracts remain unresolved. Specifically, the performance of these methods tends to degrade over time, and in some cases, they may even fail entirely. A key factor contributing to this dilemma is the regular updates of Solidity versions. These updates often introduce new features or syntax changes, which significantly influence how vulnerabilities are manifested and detected. To tackle this challenge, we propose Triplet Detection (TD), a triplet learning-based vulnerabilities detection framework, to preserve invariant vulnerability knowledge across multiple Solidity versions. In TD, we propose a novel Smart Offline Mining (SOM) strategy to guide triplet selection, ensuring the learned embedding capture both foundational and version-independent vulnerability features. The experimental results demonstrate that TD outperforms state-of-the-art vulnerability detection tools and baseline methods. Furthermore, TD achieves superior performance in detecting vulnerabilities across different versions of smart contracts (e.g., from v0.4 to v0.8), highlighting its capability to tackle the challenges of long-term reliability and adaptability in detection models due to the updates of smart contract versions.