Detecting Vulnerabilities in EOSIO Smart Contracts via Joint Static and Dynamic Feature Learning

Abstract

This paper addresses the security challenges of EOSIO smart contracts, which are deployed in WebAssembly bytecode, frequently targeted by attacks, and inherently difficult to analyze. Existing approaches typically suffer limitations that either rely on symbolic execution with handcrafted rules, which faces scalability and coverage limits, or emphasize purely dynamic fuzzing, which often lacks semantic precision. To this end, we propose a deep learning based detection approach that performs joint modeling and analysis of both static and dynamic characteristics. On the static side, we construct graph representations from multiple perspectives, including control-flow and data-dependency graphs, and semantic paths, to capture the structural and semantic properties of contracts. On the dynamic side, we design a multi-granularity and configurable instrumentation mechanism within the Wasm execution environment to collect runtime traces, system API invocations, and contextual signals related to permissions and notifications. Based on both structural and behavioral information, we build a multimodal learning model to detect four representative categories of EOSIO-specific vulnerabilities. Experimental results demonstrate that our method achieves superior detection performance, with an average precision of 84.7% and a Macro-F1 score of 85.3%, outperforming representative static and dynamic baselines in our evaluation.