CPGNet: A Cross-aligned Penetrative Graph Network for Smart Contract Vulnerability Detection

Abstract

Smart contracts are immutable programs that automatically execute predefined logic. Once deployed, their underlying vulnerabilities are notoriously difficult to patch and highly susceptible to malicious exploitation, often leading to severe financial losses. Although existing vulnerability detection methods have demonstrated certain advantages, they still fail to achieve adequate structural–semantic coverage of vulnerability-relevant behaviors, as they are unable to jointly model opcode semantics, control-flow transitions, and data-dependency relations. To overcome these limitations, this paper proposes a novel smart contract vulnerability detection model named Cross-aligned Penetrative Graph Network (CPGNet). Specifically, CPGNet first constructs control flow graphs and data flow graphs from the abstract syntax tree, and combines them with opcode semantic embeddings to form a multidimensional initial code representation. Based on this representation, a cross-alignment mechanism is introduced to effectively capture and integrate the complex interactions between control-flow transitions and data-flow dependencies. Furthermore, an explicit–implicit feature penetration architecture is designed to inject shallow local opcode patterns into the deep semantic modeling process, enabling multi-source features to dynamically complement each other. By jointly modeling opcode semantics, control-flow structures, and data-dependency relations, CPGNet significantly enhances the representation capability for hidden and complex vulnerability patterns. Experimental results on two datasets show that CPGNet achieves stable performance, with F1-scores of 88.69% and 90.58% on the benchmark Ethereum dataset, and 78.10% and 71.53% on DIVE for reentrancy and timestamp dependency detection, respectively. These results verify the effectiveness of jointly modeling opcode semantics and graph-level structural dependencies.