EthCluster: An Unsupervised Static Analysis Method for Ethereum Smart Contract

arXiv:2504.09977 · cs.CR · Submitted 2025-04-14 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia, and with me are Elias and Priya, guest researcher.

Elias: Today's paper: "EthCluster: An Unsupervised Static Analysis Method for Ethereum Smart Contract".

Nadia: The gist The model identifies five specific vulnerabilities—Reentrancy, Access Control, Timestamp Dependency, tx.origin misuse,

Elias: First, who's behind it and why it matters.

Title and authors: Nadia: So we just touched on the title and authors of "EthCluster: An Unsupervised Static Analysis Method for Ethereum Smart Contract" and their basic idea, which is using clustering instead of labeled data to find flaws in smart contracts.

Elias: Right, they're tackling that imbalance issue where there are too few real attack incidents to train accurate supervised models. They introduce this unsupervised method to find latent vulnerabilities.

Nadia: It sounds like they're moving away from needing tons of labeled examples and instead letting the data speak for itself by clustering contracts based on their source code features.

Priya: The paper explains that they use clustering algorithms to distribute contract data, and a contract is flagged as abnormal if it doesn't cluster near the normal data points. That's how they figure out what's potentially vulnerable.

The paper's summary: Nadia: To summarize the core idea of "EthCluster: An Unsupervised Static Analysis Method for Ethereum Smart Contract," the method works by first processing the Solidity source code into features.

Elias: They use six different steps for this processing, including data pre-processing, regular expression detection for specific issues like reentrancy, and word vector construction.

Nadia: The feature engineering part is interesting because they build word vectors using Gensim's Word2Vec and then filter them down using TF-IDF to select the most important keywords for clustering.

Priya: And they use PCA for dimensionality reduction before running the K-means algorithm, which helps make the clustering process work better by cutting down on the number of variables.

The paper's improvements: Nadia: The authors suggest several ways to improve this approach. They focus on making sure their feature selection isn't too restrictive or too broad when using that TF-IDF score threshold.

Elias: They also mention tuning the K-means parameters, specifically the number of clusters and the maximum iterations, because those settings really depend on how you're applying it to a specific scenario.

Nadia: And they bring up improving robustness by heuristically determining the appropriate cluster size for each vulnerability type. That way, instead of one setting for everything, you tailor it per flaw.

Priya: They also point out that using the Euclidean Distance formula to measure distance between data points during the K-means process is what guides how they classify things as vulnerable or not.

Conclusion: Nadia: So to wrap up "EthCluster: An Unsupervised Static Analysis Method for Ethereum Smart Contract," they're presenting a method that uses unsupervised learning and clustering to detect five specific vulnerabilities in smart contracts.

Elias: The authors show some high performance metrics, for example, for Reentrancy, they report a True Positive of eighty-one and an overall Accuracy of ninety-seven point four one percent.

Nadia: And they also find similar accuracy across the other types they tested, like Timestamp Dependency and tx.origin misuse. It shows the method is quite consistent across different attack patterns.

Priya: The limitation they state is that this unsupervised method relies on identifying patterns in the training data itself, which means it might miss novel vulnerabilities that don't look like anything it's seen before.

Nadia: That makes sense. So, in short, "EthCluster" is an unsupervised approach using clustering to find those five specific smart contract flaws without needing massive labeled datasets from attack incidents.

Elias: It’s a way to get pseudo-labeling for vulnerabilities that are hard to find manually. The next thing we should look at is how the authors handle the data imbalance challenge in more detail.

Priya: Yeah, yeah, so when we talk about those rare real-world incidents, it highlights how challenging anomaly detection really is in this space.

Institute of Information Security, National Tsing Hua University

cs.CR

Submitted: 2025-04-14

Updated: 2026-10-14

Comments: 9 pages, 7 figures

Code: https://github.com/Scientia-Potentia-Est-Tw/EthCluster

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 72/100

The gist: The gist The model identifies five specific vulnerabilities—Reentrancy, Access Control, Timestamp Dependency, tx.origin misuse, and Unchecked LowLevel Calls—in Solidity source code for Ethereum

Key concepts

Unsupervised Learning: This method trains a model without pre-labeled examples of vulnerabilities. Instead, it learns the inherent structure of 'normal' smart contract code by analyzing vast amounts of existing contract data. When new code is analyzed, if it doesn't fit into the established patterns of normal contracts, it is flagged as an anomaly or potential vulnerability.
K-means Clustering: K-means is a grouping algorithm used to partition data points into 'k' distinct clusters. In this context, the algorithm groups smart contracts based on their code features (like word vectors). Contracts that fall far outside these established, normal clusters are considered outliers and are then classified as potentially vulnerable smart contracts.
Feature Engineering Pipeline: This is the process of transforming raw Solidity source code into numerical data that a machine learning model can understand. This pipeline involves several steps: converting code to text, using regular expressions to find specific risky patterns (like those for reentrancy), and then creating word vectors from keywords to represent the contract's unique characteristics.
Anomaly Detection: This is the core strategy used here, treating vulnerability detection as finding 'abnormal' behavior rather than looking for known threats. Since financial vulnerabilities are rare, the system learns what 'safe' code looks like. Any contract that deviates significantly from this learned safe pattern is flagged as an anomaly requiring further security review.

Terminology

Clustering — 55× in this paper · explained in 2 episodes
Unsupervised Learning — 15× in this paper · explained in 2 episodes
Accuracy — 13× in this paper · explained in 1 episode
K-means Clustering — 12× in this paper · explained in 3 episodes
Nadia — 9× in this paper · explained in 2 episodes
Benchmark — 8× in this paper · explained in 2 episodes
Elias — 5× in this paper · explained in 2 episodes
Feature Extraction — 5× in this paper · explained in 3 episodes
Feature Selection — 4× in this paper · explained in 4 episodes
Principal Component Analysis — 4× in this paper
Principal Component Analysis (PCA) — 4× in this paper · explained in 5 episodes
Core — 3× in this paper · explained in 2 episodes
Decentralized Application Security Project — 3× in this paper
Feature Engineering — 3× in this paper · explained in 3 episodes
Fine-Tuning — 3× in this paper · explained in 5 episodes
Generative AI — 3× in this paper · explained in 2 episodes
Term Frequency — 3× in this paper
True Positive — 3× in this paper
Continuous Bag of Words — 2× in this paper
False Negative — 2× in this paper
False Positive — 2× in this paper
Inverse Document Frequency — 2× in this paper
Pseudo-labeling — 2× in this paper · explained in 3 episodes
Transformer — 2× in this paper · explained in 2 episodes
Transformers — 2× in this paper · explained in 2 episodes
True Negative — 2× in this paper
Embeddings — 1× in this paper · explained in 2 episodes
Few-Shot Learning — 1× in this paper · explained in 4 episodes
Robustness — 1× in this paper · explained in 5 episodes

Summary

The gist The model identifies five specific vulnerabilities—Reentrancy, Access Control, Timestamp Dependency, tx.origin misuse, and Unchecked LowLevel Calls—in Solidity source code for Ethereum smart contracts using an unsupervised learning approach based on clustering algorithms to detect outliers that are classified as vulnerable smart contracts<ref:2504.09977#pg2>

How it works

The core method involves training a model using unsupervised learning to identify vulnerabilities in the Solidity source code for Ethereum smart contracts<ref:2504.09977#pg2>. Given the rarity of financial vulnerability incidents on Ethereum, the researchers adopt an anomaly detection approach, defining their problem as a one-class classification task for each vulnerability type<ref:2504.09977#pg2>. The model is designed to inspect real-world smart contracts from seven blockchain explorer platforms, including Etherscan, BscScan, and PolygonScan<ref:2504.09977#pg2>. To address the challenges posed by real-world smart contracts, the training data is based on actual vulnerability samples from datasets such as SmartBugs Curated and the SolidiFI Benchmark<ref:2504.09977#pg2>. These datasets enable them to construct a robust, unsupervised static analysis method to detect five specific vulnerabilities—Reentrancy, Access Control, Timestamp Dependency, tx.origin misuse, and Unchecked LowLevel Calls—using clustering algorithms to identify outliers<ref:2504.09977#pg2>.

Data Processing and Feature Extraction

The data processing involves several steps designed to prepare the source code for clustering<ref:2504.09977#pg2>. These six methods include Data Pre-Processing, Regular Expression Detection, Word Vector Construction, TF-IDF Filter, Principal Component Analysis (PCA) Dimensionality Reduction, and K-means Clustering<ref:2504.09977#pg2>. Data Pre-Processing requires removing noise from the contracts by converting.sol files to.txt text files and removing fixed keywords in Solidity<ref:2504.09977#pg2>. Regular Expression Detection is integrated for specific vulnerabilities, such as Reentrancy, Timestamp Dependency, tx.origin usage, and Unchecked Low-Level Calls<ref:2504.09977#pg2>. For example, the pattern for a reentrancy vulnerability is designed to detect the call keyword and if the balance(s) keyword appears within five lines<ref:2504.09977#pg2>.

Feature Engineering Pipeline

The feature engineering pipeline constructs word vectors using Gensim's Word2Vec [17] to transform vulnerable sentences into data points<ref:2504.09977#pg2>. Several parameters are considered for Word2Vec, such as documents, vector size, window, min count, workers, sg (defining CBOW or Skip-gram), and epochs<ref:2504.09977#pg2>. After constructing the word vectors, Gensim's TFIDF [18] is used for feature selection to determine which keyword vectors will be used to represent the features of the contract for clustering<ref:2504.09977#pg2>. A tfidf score threshold is applied, where word vectors with a score above this value are added to the dataset for clustering<ref:2504.09977#pg2>. When reading vectors of each contract in the corpus, the results of the regular expression detection are checked; if an array element is 1, the keyword's word vector is directly added to the word vector tfidf list<ref:2504.09977#pg2>.

Clustering and Classification

The final step involves K-means Clustering using the PyTorch k-means library for clustering<ref:2504.09977#pg2>. The approach combines K-means with PCA for dimensionality reduction, which is noted to achieve excellent performance<ref:2504.09977#pg2>. The Euclidean Distance formula is used to measure distance between data points in the k-means process<ref:2504.09977#pg2>. The number of clusters (num clusters) and max iterations are important parameters that need to be tested and adjusted based on the specific application scenario<ref:2504.09977#pg2>. The clustering results show that the first 30% contain vulnerable phrases, while the remaining 70% are non-vulnerable<ref:2504.09977#pg2>.

Experimental Results

The effectiveness of the unsupervised learning approach depends on the characteristics of the dataset<ref:2504.09977#pg2>. The evaluation metrics used are Accuracy (ACC), Precision (P), Recall (R), and F-measure (F)<ref:2504.09977#pg2>. For Reentrancy, the results show a True Positive of 81, a False Positive of 30%, a False Negative of 7%, and a True Negative of 182<ref:2504.09977#pg2>. The overall Accuracy for Reentrancy is 97.41%, Precision is 92.05%, Recall is 100, and the F-measure is 95.86%<ref:2504.09977#pg2>. Similar high performance metrics are observed across other vulnerabilities, including Timestamp Dependency (ACC 95.65%, P 96.08%, R 89.09%, F 92.45%) and tx.origin (ACC 100, P 100, R 100, F 100)

Discussion and Future Directions

The paper discusses the challenges related to data imbalance in anomaly detection methods. The authors note that the number of real-world samples of actual incidents is exceedingly rare, and generative AI models are limited by constraints on length and speed, making them impractical for generating large volumes of training data. The continuous development of new methods, such as Few-Shot Learning, Zero-Shot Learning, and Contrastive LanguageImage Pre-training (CLIP), presents potential avenues for future advancements and optimization of the system.

Conclusion

In this paper, the authors decided to adopt an unsupervised deep learning approach using clustering algorithms to establish a static analysis system<ref:2504.09977#pg2>. They utilized dynamic web crawlers to send API requests to target websites, retrieving smart contract source code from the Ethereum public blockchain<ref:2504.09977#pg2>. The retrieved data was stored in MongoDB for subsequent testing purposes<ref:2504.09977#pg2>. They developed a model based on clustering algorithms to distribute the contract data within the datasets across various clusters, classifying contracts as abnormal if they do not cluster around normal data points<ref:2504.09977#pg2>.

Acknowledgment

This research was supported in part by the Ministry of Science and Technology, Taiwan, under Project MOST 111-2221-E-007-078-MY3.

References

[1] NCC Group, “Decentralized Application Security Project,” 2018, https://dasp.co.

[2] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina N. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” 2018.

[3] Yu-Chang Shen and Hung-Min Sun, “Fine-tuning Natural Language Processing Model BERT to Detect Smart Contract Vulnerabilities,” 2022.

[4] Yuan-Chia Tsai and Hung-Min Sun, “Graph Attention Network for Smart Contract Vulnerability Detection,” 2022, unpublished.

[5] Varun Chandola, Arindam Banerjee, and Vipin Kumar. “Anomaly detection: A survey,” ACM Comput. Surv. 41, 3, Article 15, July 2009.

[6] Man, K.W., “Predicting software vulnerabilities with unsupervised learning techniques,” http://resolver.tudelft.nl/uuid:80c1b078-b8ca4c29-b0ba-866fdc5f656b, 2020.

[7] Lindsay I Smith, “A tutorial on principal components analysis,” Technical report, 2002.

[8] Jain, A.K. (2008). Data Clustering: 50 Years Beyond K-means. In: Daelemans, W., Goethals, B., Morik, K. (eds) Machine Learning and Knowledge Discovery in Databases. ECML PKDD 2008.

[9] Sik-Ho Tsang, “Review-Word2Vec: Efficient Estimation of Word Representations in Vector Space,” https://sh-tsang.medium.

Improvements for AI systems

Bold Header: Incorporate Regular Expression Detection for Specific Vulnerabilities

This improvement allows for direct detection of certain vulnerabilities beyond general keyword analysis by integrating a regular expression-based detection mechanism to flag patterns like Reentrancy, Timestamp Dependency, tx.origin usage, and Unchecked Low-Level Calls.

Bold Header: Enhance Feature Selection with TF-IDF Threshold Adjustment

The system can be made more robust by dynamically adjusting the tfidf score as a threshold, which directly impacts feature selection to prevent both insufficient features (if the threshold is too high) and an excessive number of features (if it's too low).

Bold Header: Optimize Clustering with PCA for Dimensionality Reduction

Applying Principal Component Analysis (PCA) before K-means clustering ensures improved performance by reducing the dimensionality of word vectors, as stated in the text: PCA is a widely used dimensionality reduction technique that decreases the number of variables by extracting the principal components from the data.

Bold Header: Refine Feature Engineering through Word2Vec and TF-IDF Combination

The system can better capture semantic relationships by using Word2Vec to transform keywords into high-dimensional vectors, which are then filtered using TF-IDF scores to create a more meaningful feature set for clustering.

Bold Header: Improve Anomaly Detection Robustness via K-means Parameter Tuning

The model's effectiveness against data imbalance can be increased by heuristically determining the appropriate cluster size for each vulnerability and fixing the PyTorch seed to ensure consistent selection of cluster centers in each execution.

Bold Header: Increase Data Diversity through Continuous Testing Data Acquisition

By maintaining weekly updates of testing data collected via crawlers, the system mitigates the issue of an imbalance between training and testing data, addressing the challenge that the number of contracts stored in MongoDB continues to grow.

Abstract

Poorly designed smart contracts are particularly vulnerable, as they may allow attackers to exploit weaknesses and steal the virtual currency they manage. In this study, we train a model using unsupervised learning to identify vulnerabilities in the Solidity source code of Ethereum smart contracts. To address the challenges associated with real-world smart contracts, our training data is derived from actual vulnerability samples obtained from datasets such as SmartBugs Curated and the SolidiFI Benchmark. These datasets enable us to develop a robust unsupervised static analysis method for detecting five specific vulnerabilities: Reentrancy, Access Control, Timestamp Dependency, tx.origin, and Unchecked Low-Level Calls. We employ clustering algorithms to identify outliers, which are subsequently classified as vulnerable smart contracts.