Graph Neural Networks Enhanced Smart Contract Vulnerability Detection of
  Educational Blockchain
With the development of blockchain technology, more and more attention has
been paid to the intersection of blockchain and education, and various
educational evaluation systems and E-learning systems are developed based on
blockchain technology. Among them, Ethereum smart contract is favored by
developers for its ``event-triggered" mechanism for building education
intelligent trading systems and intelligent learning platforms. However, due to
the immutability of blockchain, published smart contracts cannot be modified,
so problematic contracts cannot be fixed by modifying the code in the
educational blockchain. In recent years, security incidents due to smart
contract vulnerabilities have caused huge property losses, so the detection of
smart contract vulnerabilities in educational blockchain has become a great
challenge. To solve this problem, this paper proposes a graph neural network
(GNN) based vulnerability detection for smart contracts in educational
blockchains. Firstly, the bytecodes are decompiled to get the opcode. Secondly,
the basic blocks are divided, and the edges between the basic blocks according
to the opcode execution logic are added. Then, the control flow graphs (CFG)
are built. Finally, we designed a GNN-based model for vulnerability detection.
The experimental results show that the proposed method is effective for the
vulnerability detection of smart contracts. Compared with the traditional
approaches, it can get good results with fewer layers of the GCN model, which
shows that the contract bytecode and GCN model are efficient in vulnerability
detection.
Zhifeng Wang, Wanxuan Wu, Chunyan Zeng, Jialong Yao, Yang Yang, Hongmin Xu
# Graph Neural Networks Enhanced Smart Contract Vulnerability Detection of Educational Blockchain

###### Abstract

With the development of blockchain technology, more and more attention has been paid to the intersection of blockchain and education, and various educational evaluation systems and E-learning systems are developed based on blockchain technology. Among them, Ethereum smart contract is favored by developers for its "event-triggered" mechanism for building education intelligent trading systems and intelligent learning platforms. However, due to the immutability of blockchain, published smart contracts cannot be modified, so problematic contracts cannot be fixed by modifying the code in the educational blockchain. In recent years, security incidents due to smart contract vulnerabilities have caused huge property losses, so the detection of smart contract vulnerabilities in educational blockchain has become a great challenge. To solve this problem, this paper proposes a graph neural network (GNN) based vulnerability detection for smart contracts in educational blockchains. Firstly, the bytecodes are decoupled to get the opcode. Secondly, the basic blocks are divided, and the edges between the basic blocks according to the opcode execution logic are added. Then, the control flow graphs (CFG) are built. Finally, we designed a GNN-based model for vulnerability detection. The experimental results show that the proposed method is effective for the vulnerability detection of smart contracts. Compared with the traditional approaches, it can get good results with fewer layers of the GCN model, which shows that the contract bytecode and GCN model are efficient in vulnerability detection.

 educational blockchain, smart contract, byte-code, vulnerability detection

## I Introduction

The education blockchain refers to the use of blockchain as technical support when carrying out reforms to the traditional education systems [1, 2]. The white paper on blockchain technology released by China in 2016 states that "the transparency and immutability of the blockchain system are perfectly suitable for student credit management, further education and employment, academics, qualification certification, and industry-academia cooperation, and are of great value to the healthy development of education and employment" [3]. According to the visual analysis of the blockchain in education [4, 5, 6], blockchain technology is using its decentralized feature to break the absolute management power of traditional education administrators over education and promote the development of education in the direction of more equity [7, 8]. With the creation and development of Ethernet smart contract technology, programs can be implemented to automatically execute without third-party intervention after meeting the conditions to achieve functions such as controlling the assets of the blockchain and storing data information. By embedding smart contracts, blockchain technology can build virtual economy education intelligent transaction systems [9], which can promote the construction of a new system combining the Internet and education, avoid the limitations of the traditional education model in space and time to a certain extent, and help promote the change of the education system and accelerate its development.

Blockchain-based smart contract systems have many advantages, such as ensuring the authenticity [10] and security of information [11, 12], saving human resources, improving the efficiency of program execution, etc. However, smart contracts are not absolutely secure. Different security vulnerabilities may exist throughout the life cycle of a smart contract, and due to the published code cannot be modified, the security problems caused by smart contract vulnerabilities will increase, so it is especially important to improve its security.

For example, the main detection in this paper is a timestamp dependency vulnerability. Smart contracts use timestamps to control certain important block control flow decisions, and if an attacker masquerades as a miner, they can bypass certain operations in the contract that are restricted by timestamps by maliciously controlling the range of timestamp generation.

With the continuous development of deep learning techniques, some scholars have proposed the use of these techniques for vulnerability detection to make it more accurate, comprehensive, and efficient. This paper uses Control Flow
Graph (CFG) built based on bytecode files of smart contracts, use it as the input of a graph neural network, and builds a Graph Convolutional Network (GCN) model to realize vulnerability detection of smart contracts. The contributions of this paper can be summarized as follows:

* A GCN model is built and successfully predicts contract vulnerabilities for the educational blockchain.
* The vulnerabilities can be effectively detected through the bytecode files of smart contracts.
* The accuracy of model prediction can be increased if semantic processing is added or classification of edges is added.

The rest of the paper is organized as follows. In Section 2, we review the related work. In Section 3, we introduce the main research methods, including CFG composition and GCN model. In Section 4, we describe the details of the experiment and the results. Finally, we have a summary of this work in Section 5.

## II Related Work

We first introduce the contractual vulnerability detection methods that are now available. Then we summarize the development of graph convolutional neural networks.

### _Contract Vulnerability Detection Methods_

In response to the security problems caused by smart contracts, numerous research teams at home and abroad have proposed solutions that seek to protect users' property security and data security. The current detection techniques mainly include two types, one is based on non-deep learning methods and the other is based on deep learning methods.

A non-deep learning-based method, the automated contract vulnerability mining tool Oyente [13], is a symbolic execution-based analysis method. Using the bytecode file of a smart contract as input, after analyzing the bytecode and constructing the CFG, the Z3 solver is used to analyze the conditional jumps in the contract, which can predict whether there are seven types of vulnerabilities such as integer overflow errors and reentrant vulnerabilities for that contract.

Another non-deep learning-based approach, ContractFuzzer, is a fuzzy test-based detection tool. It consists of two parts, an offline EVM staking tool and an online fuzzy testing tool [14]. The tool generates legally valid inputs and mutated inputs that cross the valid boundary by analyzing the bytecode of the smart contract as well as the ABI interface; after starting the fuzzy test, the detection results of the contract can be obtained through the execution log.

A deep learning-based approach uses RNN networks. an RNN is a recurrent neural network that uses sequence data as input to a neural network, recursively in the direction of sequence data and with all recurrent units connected in a chain-like manner [15]. In the RNN network model proposed in the literature [16], two layers of threshold recursive units (GRUs) are connected after the embedding layer, and the fully connected layer is connected afterward. This experiment demonstrates that vulnerability detection can be done using smart contract operation sequences combined with deep learning networks.

Another deep learning-based method can use the Long Short-Term Memory Network (LSTM) [17], a model that constructs three gates: input, output, and forgetting gates, implementing an optimization of the RNN and therefore providing further performance improvements. The use of this network model for vulnerability detection is proposed in the literature [18], using a binary vector encoding representing the opcode of a smart contract as an input to the network model, and its experimental results show more effective detection results in contrast to non-deep learning methods.

### _Graph Convolutional Network Model_

The graph neural network model used in this paper is the GCN. It is a model evolved from Spectral CNN and Chebyshev Network (ChebNet) [19]. The important architecture of GCN includes a graph convolution layer, a graph readout layer, and a graph regularization layer to improve model generalization performance and a graph pooling layer to reduce the number of computational parameters. The GCN model is essentially the same as a Convolutional Neural Network (CNN) [20], i.e., it aggregates pro-domain information for operation, but the difference is that the GCN model applies to data with a non-Euclidean structure.

Because the GCN network deals with graph structures, it needs to be represented as multiple files during data pre-processing, such as adjacency matrix, number of nodes and information, number of edges and information, etc.

Since its introduction, the GCN network model has received a lot of attention from scholars from all walks of life and has been actively applied to various application sites of graph data. Currently, the GCN network model has been applied to the blockchain, biochemistry, traffic prediction, computer vision, and other fields with promising results [21].

## III Proposed Method

Smart contracts are run by EVM, which first compiles the source code into bytecode and then runs it as bytecode, so it is more realistic to use bytecode files as the basis for vulnerability detection.

Inspired by the success of deep learning in the fields of data mining [22, 23, 24, 2, 25], computer vision [26, 27, 20, 21, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 188, 189, 200, 21, 22, 23, 24, 25, 26, 27, 28, 29, 21, 23, 25, 26, 29, 22, 27, 29, 28, 22, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 72, 73, 74, 75, 76, 77, 78, 79, 80, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 99, 111, 12, 13, 14, 14, 15, 16, 17, 17, 18, 18, 19, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 34, 35, 36, 38, 37, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 83, 84, 85, 86, 87, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 99, 11, 12, 13, 14, 15, 16, 17, 18, 19, 19, 20, 21, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 99, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 89, 91, 92, 93, 94, 95, 96, 97, 98, 99, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 9,
2. Divide the basic blocks, add dependent edges to the basic blocks to build CFG, and use them as input to the GCN;
3. Define the convolutional network layer of GCN;
4. Add pooling layer, fully connected layer, etc. to build a complete GCN model.

### _Byte Code Analysis_

#### Iii-A1 Contract Bytecode Structure

The source code of a smart contract is compiled to generate bytecode, which is divided into three parts: deployment code, runtime code, and auxdata. When EVM builds a contract, it first creates the contract user, then runs the deployment code and deposits the two parts, runtime code and auxdata, onto the blockchain, and in the actual operation of the contract, it is the runtime code that runs; the last 43 bytes of each contract are auxdata, which will be saved following the runtime code. An example of bytecode structure is given below as shown in Fig. 2.

#### Iii-A2 Assembly Opcode

The decompiled code can be obtained by disassembling the bytecode. The decompiled code consists of two parts: the instruction address and the instruction opcode. Since the smart contract only runs the runtime code part when it is executed, the decompilation operation on the bytecode only needs to operate on the runtime code part.

Up to now, EVM has used 145 opcodes, which can be divided into arithmetic operation instructions, comparison operation instructions, per-bit operation instructions, cryptographic calculation instructions, stack, memory, and storage operation instructions, jump instructions, block, and smart contract related instructions, etc. according to their functions. The specific opcodes are divided as shown in Table I.

An example of decompiling the bytecode is given below, as shown in Fig. 3.

### _Control Flow Graph Generation_

Building a CFG using the bytecode of a smart contract involves the following main steps.

1. Disassembling the hexadecimal bytecode file to obtain the corresponding assembly opcode.
2. Dividing the opcode into some basic blocks according to the rules for building basic blocks.
3. Calculating the destination address of each basic block according to transfer instructions such as jump instructions and conditional instructions, and adding edges between the corresponding two basic blocks, thus completing the construction of the control flow graph (CFG).

Fig. 1: A description of the experimental procedure. The first part is the process of constructing CFG, and the second part is the process of constructing GCN model and inputting data for vulnerability prediction.

\begin{table}
\begin{tabular}{c|c|c} \hline
**OPCODE** & **FUNCTION** & **EXAMPLE** \\ \hline
0.00\(\pm\) 0.00B & Stopping and Arithmetic Operation & ADD, SUB, STOP, DIV \\
0.01\(\pm\) 0.01A & Comparison and By-bit Logic Operations & GT, LT, ISO \\
0.020 & Encryption & SHA3 \\
0.03\(\pm\) 0.03E & Environmental Information & ADDRESS, CALLER \\
0.04\(\pm\) 0.045 & Block Operations & BLOCKHASH, COMPASE \\
0.05\(\pm\) 0.5B & Storage and Execution & POP, JUMP, LIMIT \\
0.05\(\pm\) 0.5B & Push Operation & PUSH1 - PUSH32 \\
0.08\(\pm\) 0.8F & Copy Command & DUT-DUT-DUT6 \\
0.09\(\pm\) 0.9F & Exchange instructions & SWAP1 - SWAP16 \\
0.0A0 -0.8A/4 & Logging Instructions & LOG0 - LOG4 \\
0.0F0 -0.8F & System Command & CALL, RETURN \\ \hline \end{tabular}
\end{table}
Table I: The classification of EVM opcodes and the functions of each category, with a few examples.

Fig. 3: An example of decompiling the bytecode file of a smart contract to get the opcode.

Fig. 2: The bytecode file of a smart contract consists of three parts: deployment code, runtime code, and auxdata.
4. Based on CFG, sequential dependent edges are added between the sequentially executed basic blocks to improve the graph structure.

The above section has analyzed the bytecode of the smart contract and described how to get the opcode. The next section describes how to build the CFG.

#### Iii-B1 Basic Block Division

A basic block is a maximized sequence of instructions in which the execution of an instruction can only start from the first instruction and end with the last instruction. A code file can generate a graph structure by dividing the basic blocks and adding jump dependencies and sequential dependencies.

The following are three basic principles for constructing a basic block.

1. If this instruction is the first instruction of a program or subroutine, the current basic block should be terminated and a new basic block should be opened with this instruction as the first instruction in it.
2. If this instruction is a jump statement or branch statement, etc., the instruction should be used as the last instruction of the current basic block, and then the basic block should be terminated.
3. If the instruction does not belong to the above two cases, it is added directly to the current basic block.

An example of a bytecode file divided into basic blocks is given below, as shown in Fig. 4.

#### Iii-B2 CFG Structure Construction

After the work of dividing the basic blocks is completed, it is necessary to add new edges to the basic blocks in combination with assembly instructions, i.e., the jumping relationships between the basic blocks. The complete diagram structure after adding sequential edges to the basic blocks divided in the above section is shown in Fig. 5.

### _GCN Model_

#### Iii-C1 Convolutional Layer Definition

The underlying equation of GCN is shown in equation 1.

\[H^{l+1}=\sigma(\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}H^{l}w ^{l}) \tag{1}\]

where \(H^{l}\) is the input feature of the lth layer and \(H^{l+1}\) is the output feature. \(w^{l}\) is the linear transformation matrix, i.e., the weight matrix that the model needs to learn, and \(\sigma(\cdot)\) is the nonlinear activation function, such as ReLU, Sigmoid, etc. \(\tilde{A}\) is the adjacency matrix with self-connections (hereafter referred to as the self-connected adjacency matrix), defined as shown in equation 2.

\[\tilde{A}=A+I \tag{2}\]

\(A\) is the adjacency matrix and \(I\) is the unit matrix. In the adjacency matrix, the elements at the diagonal positions represent the relationship between the node and itself, while the elements at the non-diagonal positions represent the relationship between the node and the node. If a node is not connected to itself, the element at the diagonal position is 0. However, such a setting will cause problems in subsequent calculations, i.e., it is impossible to distinguish between "own nodes" and "unconnected nodes" (both of which have the corresponding element position of 0).

An example is given below to better illustrate the definition of the matrix, as shown in Fig. 6.

\(\tilde{D}\) is the degree matrix of the self-connected matrix, defined as shown in equation 3.

\[\tilde{D_{ij}}=\sum_{j}\tilde{A}_{ij} \tag{3}\]

The definition of the degree matrix is still illustrated below using the data in Fig. 6, where \(\tilde{D}^{-\frac{1}{2}}\) is the inverse of the square root taken from the basis of the self-connected degree matrix, as shown in equation 4.

\[\tilde{A}=\begin{bmatrix}1&1&1&1&0\\ 0&1&0&0&0\\ 0&0&1&1&0\\ 0&0&0&1&1\\ 1&0&0&0&1\end{bmatrix}\tilde{D}=\begin{bmatrix}4&0&0&0&0\\ 0&1&0&0&0\\ 0&0&2&0\\ 0&0&0&2&0\\ 0&0&0&0&2\end{bmatrix}\tilde{D}=\begin{bmatrix}1&1&1&1&0\\ 0&1&0&0\\ 0&1&1&0\\ 0&0&0&1&1\\ 1&0&0&0&1\end{bmatrix} \tag{4}\]

#### Iii-C2 GCN Model Definition

The model is used to predict the label \(\hat{y}\), when \(\hat{y}=1\), it indicates that there is some vulnerability, otherwise, it indicates that the smart contract

Fig. 4: According to the three principles of dividing basic blocks, the opcode obtained by decompiling can be divided into several basic blocks.
is secure. The network model is described below, the specific network model is shown in Fig. 7.

The network model consists of an input layer, an output layer, and some hidden layers, where each layer is computed and the results are fed into the activation function \(ReLU(\cdot)\). After several layers of computation, a prediction label is an output by the output layer, where 1 indicates that the contract has some kind of vulnerability, otherwise it indicates that the contract is secure.

The process of CFG construction has been described in the previous section, using the adjacency matrix A and the node feature matrix X to represent the corresponding CFG as the input to the network model. Since the work in this paper does not involve natural semantic processing for the operand part, the node feature matrix X will be used instead of the unit matrix.

In this paper, we try to detect smart contracts using a network model containing hidden layers from 1 to 4 layers, examine the effect of the number of network layers on each evaluation metric, and analyze the reasons for metric changes.

## IV Experimental Results and Analysis

In this section, we first introduce the dataset for the experiments, and then describe the details and results of the experiments.

### _Smart Contracts Dataset_

The current public dataset of smart contracts is in the form of source code, so you need to compile the smart contract source code file based on the public dataset and get the smart contract bytecode file according to the compiler version declared inside the contract. It should also be noted that different versions of smart contract compilers are not compatible with each other, so the compilation process should strictly follow the declared compiler version to avoid problems due to the compiler version.

In this paper, we use the publicly available source code dataset for compilation, produce a dataset containing 1420

Fig. 5: After getting the basic blocks, we first add jump edges between the basic blocks according to the jump logic of the opcode, and then add sequential edges between the basic blocks according to the code running flow.

Fig. 6: Definition of \(\bar{A}\) matrix.

Fig. 7: The GCN model structure used in this paper uses a network model with different layers of hidden layers to predict contract vulnerabilities.
bytecodes, and assign a label to each data (set to 1 for the existence of vulnerabilities, otherwise set to 0), among which 472 contain timestamp-dependent vulnerabilities. The dataset was divided into a training set and a test set according to 8:2.

### _Experimental Results_

In this paper, four metrics are used to judge the effectiveness of the model for vulnerability prediction, namely Accuracy, Recall, Precision, and F1-score. TP, FN, FP, and TN are used to represent the classification of the prediction results, where TP denotes contracts that detect the presence of vulnerabilities but have vulnerabilities, FN denotes contracts that detect no exist but have vulnerabilities, FP denotes contracts that are detected to have vulnerabilities but do not have vulnerabilities, and TN denotes contracts that are detected not to have vulnerabilities but do not have vulnerabilities.

Accuracy represents the ratio of the number of correctly detected contracts to the number of all contracts and is calculated as shown in equation 5.

\[Accuracy=\frac{TP+TN}{TP+FN+FP+TN} \tag{5}\]

Recall represents the ratio of the number of contracts detected with vulnerabilities to the number of all contracts containing vulnerabilities, and is calculated as shown in equation 6.

\[Recall=\frac{TP}{TP+FN} \tag{6}\]

Precision represents the ratio of the number of contracts detected as vulnerable and having vulnerabilities to the number of all contracts detected as containing vulnerabilities and is calculated as shown in equation 7.

\[Precision=\frac{TP}{TP+FP} \tag{7}\]

The F1-score is a comprehensive assessment metric that balances accuracy and recall and can be considered as the inverse average of accuracy and recall, which is calculated as shown in equation 8.

\[F1-score=2*\frac{Presicion*Recall}{Presicion+Recall} \tag{8}\]

During the experiment, the number of layers of the GCN model was changed to observe the changes of each index, and the results are shown in Fig. 8 (for the convenience of graphing, the "result"100" is done on each result).

From the experimental results, it is clear that the accuracy and F1 scores show an overall decreasing trend as the number of network layers increases. And it is easy to observe that there is a greater decrease in recall in the network models with 5 and 6 layers; there is also a small decrease in accuracy in the network model with 6 layers.

According to the structure of neural networks, it is known that the more layers of hidden layers, in addition to the input and output layers, the more significant the non-linearity is. In the process of model learning, which is the process of adjusting and optimizing the weights and thresholds of each connection, the neurons in the latter layer receive the abstract data from the processed neurons in the previous layer, so the higher the number of layers of the network model, the higher it's level of abstraction, and it will show better results on some specific tasks. However, in this problem, it is obvious that an excessively deep network level is not needed, and it is clear from the experimental results that the prediction results of a 3 or 4-layer network are more informative.

In addition, the work in this paper does not incorporate the semantic processing part, and the features of the graph nodes are not well characterized, which is guessed to be the reason for the low precision and F1-Score. The following conjectures may improve the accuracy of the model's prediction at present.

1. Add the semantic feature processing part. After decompiling to get the decompiled code, adding the part of natural language processing can get more optimized node feature data and make the prediction results more accurate.
2. Further classify the edges of the control flow graph, for example, they can be divided into conditional jumping edges, and sequential jumping edges, to optimize the feature data.

The current existing research has uneven work in the part of generating feature data, and the node feature data can describe the node meaning, which has a relatively large impact on the model prediction results.

### _Experiment Comparison_

This paper lists the results of other vulnerability detection methods for smart contracts, of which there are three based on non-deep learning, respectively, a smart contract automatic audit tool oyente [13], an inspection tool based on symbolic execution techniques Mythril [43], and a static analysis tool Smart check [44]; two deep learning based methods LSTM and GRU. The specific comparison results are shown in Table II.

Among these methods, the one that can achieve the best results is Mythril, with an accuracy rate of 61.08%. The reason is that its detection principle is relatively complex and requires taint analysis and other related technologies, so it

Fig. 8: Results of ablation experiments.
can achieve better results. The accuracy of deep learning-based vulnerability detection methods is slightly above 50%, but the GCN model used in this paper has better results. It has promising results under the conditions of using the basic network model and the basic composition strategy, which is sufficient to show the effectiveness of using smart contract bytecode files for vulnerability detection and the GCN model. Optimizing feature data and network models on this basis is more likely to result in better data.

## V Conclusion

This paper introduces a method of applying graph neural networks to smart contract vulnerability detection, and the experimental results show that vulnerability detection using bytecode is a feasible detection method. When constructing the network model, it is important to choose the appropriate network depth and not blindly increase the number of hidden layers. Subsequent research of such work should focus on how to generate graph structures, whether using smart contract source code or smart contract bytecode, the feature data should be able to better express the invocation relationship between functions, the execution process of the contract, and the semantics of the contract instructions. On this basis with a suitable graph neural network model, the prediction results can be further optimized.

## Acknowledgments

The research work of this paper were supported by the National Natural Science Foundation of China (No. 62177022, 61901165, 61501199), Collaborative Innovation Center for Informatization and Balanced Development of K-12 Education by MOE and Hubei Province (No. xtzd2021-005), and Self-determined Research Funds of CCNU from the Colleges' Basic Research and Operation of MOE (No. CCNU22QN013).
