dorsal/arxiv
View SchemaExamining the Effectiveness of Transformer-Based Smart Contract Vulnerability Scan
| Authors | Emre Balci, Timucin Aydede, Gorkem Yilmaz, Ece Gelal Soyak |
|---|---|
| Categories | |
| ArXiv ID | 2601.07334vv1 |
| URL | https://arxiv.org/abs/2601.07334 |
| DOI | 10.1016/j.jss.2025.112593 |
| License | http://arxiv.org/licenses/nonexclusive-distrib/1.0/ |
Abstract
Smart contract technology facilitates self-executing agreements on the blockchain, eliminating dependency on an external trusted authority. However, smart contracts may expose vulnerabilities that can lead to financial losses and disruptions in decentralized applications. In this work, we evaluate deep learning-based approaches for vulnerability scanning of Ethereum smart contracts. We propose VASCOT, a Vulnerability Analyzer for Smart COntracts using Transformers, which performs sequential analysis of Ethereum Virtual Machine (EVM) bytecode and incorporates a sliding window mechanism to overcome input length constraints. To assess VASCOT's detection efficacy, we construct a dataset of 16,469 verified Ethereum contracts deployed in 2022, and annotate it using trace analysis with concrete validation to mitigate false positives. VASCOT's performance is then compared against a state-of-the-art LSTM-based vulnerability detection model on both our dataset and an older public dataset. Our findings highlight the strengths and limitations of each model, providing insights into their detection capabilities and generalizability.
{
"annotation_id": "34c2c852-7867-43ee-b51f-a2e1c33f0338",
"date_created": "2026-02-17T05:53:12.648000Z",
"date_modified": "2026-02-17T05:53:12.648000Z",
"file_hash": "ff0cd2f3b510b019c5018ae7fd04a014bc76e9872b5ed61f0470677938246188",
"private": false,
"record": {
"abstract": "Smart contract technology facilitates self-executing agreements on the blockchain, eliminating dependency on an external trusted authority. However, smart contracts may expose vulnerabilities that can lead to financial losses and disruptions in decentralized applications. In this work, we evaluate deep learning-based approaches for vulnerability scanning of Ethereum smart contracts. We propose VASCOT, a Vulnerability Analyzer for Smart COntracts using Transformers, which performs sequential analysis of Ethereum Virtual Machine (EVM) bytecode and incorporates a sliding window mechanism to overcome input length constraints. To assess VASCOT\u0027s detection efficacy, we construct a dataset of 16,469 verified Ethereum contracts deployed in 2022, and annotate it using trace analysis with concrete validation to mitigate false positives. VASCOT\u0027s performance is then compared against a state-of-the-art LSTM-based vulnerability detection model on both our dataset and an older public dataset. Our findings highlight the strengths and limitations of each model, providing insights into their detection capabilities and generalizability.",
"arxiv_id": "2601.07334",
"authors": [
"Emre Balci",
"Timucin Aydede",
"Gorkem Yilmaz",
"Ece Gelal Soyak"
],
"categories": [
"cs.CR",
"cs.SY",
"eess.SY"
],
"doi": "10.1016/j.jss.2025.112593",
"license": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
"title": "Examining the Effectiveness of Transformer-Based Smart Contract Vulnerability Scan",
"url": "https://arxiv.org/abs/2601.07334",
"version": "v1"
},
"schema_id": "dorsal/arxiv",
"source": {
"execution_id": "49762a5f-dd98-4969-941c-a9092d07c78a",
"id": "arXiv Dataset",
"type": "Model",
"variant": "snapshot-2026-01-17",
"version": "0.1.0"
},
"user_id": 1000002
}