CGCN-DF: A Cascade GCN Vulnerability Detection Framework for Secure CIoT Smart Contracts

Abstract

With the widespread use of smart contracts in blockchain applications, particularly in the consumer Internet of Things (CIoT), the security of smart contracts has become increasingly critical. CIoT refers to an IoT environment where various consumer devices are intelligently connected and interact via the internet. In this context, smart contracts are frequently used to automate tasks such as device control, data sharing, and transaction verification. However, vulnerabilities in smart contracts can lead to system attacks, thereby compromising the security of the entire IoT network. The Cascade Graph Convolutional Network-based Vulnerability Detection Framework for smart contracts (CGCN-DF) proposed in this study effectively enhances the security assessment of smart contracts in CIoT applications. Devices and systems in CIoT environments typically exhibit high heterogeneity and complex interaction patterns, but a single graph structure cannot fully capture the multidimensional behavioral features and complex structural relationships of smart contracts. To address this issue, this paper introduces the Semantic Contract Graph (SCG), which integrates three graph representations—Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Data Flow Graph (DFG)—into a unified graph structure, comprehensively covering different aspects of the code. Furthermore, as smart contracts in CIoT environments often involve real-time data flows and complex execution paths, the CGCN-DF framework employs a cascading mechanism that performs three-level graph convolutional processing through relational, Meta-path structures, and cyclic structures. This approach extracts rich and complementary information from multi-level features, explicitly models the dynamic interactions among syntax, execution paths, and data flows, and enhances the model’s contextual awareness of vulnerability-triggering conditions. Ultimately, the framework achieves coarse-grained detection at the contract level and fine-grained detection at the line level. Experimental results demonstrate that the proposed method can effectively localize vulnerabilities down to specific code lines. This not only enhances the precision and practicality of smart contract vulnerability detection but, more importantly, contributes an innovative technical framework and theoretical methodology to the CIoT field—particularly in areas such as DSL program analysis and the intersection of IoT and blockchain security. This work thereby helps advance the field toward more refined and context-aware security analysis aligned with the realistic characteristics of complex systems.