LLM-Driven Smart Contract Vulnerability Detection Based on Heterogeneous Graphs
Abstract
As a core technology in blockchain-based systems, smart contracts are widely used in various fields. Meanwhile, their post-deployment immutability and financial nature render vulnerabilities attractive to attackers, as evidenced by significant economic losses, making smart contract vulnerability detection a critical task. Traditional detection tools mainly rely on vulnerability patterns derived from static program analysis, but are limited by expert experience and exhibit poor scalability. Recently, Large Language Models (LLMs) have emerged as a new solution for identifying smart contract vulnerabilities due to their remarkable capabilities in code understanding and reasoning. However, current prompting-based approaches are often restricted by high token overhead and the lack of domain-specific knowledge. To this end, this paper proposes an LLM-driven approach for detecting vulnerabilities in Ethereum smart contracts. First, we construct a heterogeneous graph that fuses control flow graphs (CFGs) and data flow graphs (DFGs) to capture the execution logic and transaction behavior of each smart contract with significantly reduced token consumption. Second, we leverage LLMs to extract key paths from each heterogeneous graph to filter out branches unrelated to vulnerabilities. Third, we build a knowledge repository based on the extracted key paths of both vulnerable and non-vulnerable smart contracts, together with a dual-metric retrieval mechanism. Finally, we design a Chain-of-Thought (CoT)-based prompt to guide vulnerability detection using the target smart contract's retrieved similar paths. Experiments on a public dataset of 1,093 smart contracts demonstrate the effectiveness of our approach, outperforming traditional tools by average improvements of 25.75% in accuracy and 31.44% in F1 score. Compared with LLM-based baselines, our approach achieves average improvements of 21.89% in accuracy and 26.91% in F1 score, along with a decrease of 52.88% in token consumption.