Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations

• URL: http://arxiv.org/abs/2609.01186v1
• Date: Tue, 01 Sep 2026 13:01:39 GMT
• Title: Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations
• Abstract summary: We present CVE-Smart-Contracts, a curated dataset of CVE records referring to smart contracts.<n>The dataset contains the vulnerable artifacts (source code and bytecode) according to three labels.<n>The dataset supports empirical security research, in particular the evaluation of code analysis and repair techniques.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The Common Vulnerabilities and Exposures (CVE) database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated dataset of CVE records up to July 2026 referring to Ethereum smart contracts. The dataset contains the vulnerable artifacts (source code and runtime bytecode), labels according to three taxonomies, and function-level locations. The retrieval of CVE records, collection of additional evidence, validation of the correspondence between records and artifacts, label assignment, and vulnerability localization are automated, leaving 15% to manual analysis. The dataset does not validate the original vulnerability claims, but marks a few records obviously wrong as `refuted'. For the sake of reproducibility, all external inputs are retained, so that rerunning the pipelines results in the same outputs. The dataset comprises 491 records linked to deployed contracts, 26 referring to projects (mostly libraries), 45 without validated artifacts, and six records with refuted claims. The dataset supports empirical security research, in particular the evaluation of code analysis and repair techniques.

Related papers

• The Data Problem in Software Vulnerability Analysis: Artifacts, Quality, and Consumption [15.434821716002519]
  We investigate the data behind vulnerability analysis through a dataset-centric taxonomy.<n>From a systematically assembled corpus of 1522 papers covering 2016-2026 plus foundational earlier work we deep-code a tiered set of 111 anchor papers.<n>Results trace an evidence ladder: executable artifacts are the only major type where 15 of the 24 datasets are both graded real-world and carry labels that received an independent check.
  arXiv  Detail & Related papers  (2026-09-01T16:33:30Z)
• Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing [2.0706429677946563]
  We present a vulnerability-detection method that combines vulnerability-focused code slicing, an ERC-721-oriented knowledge base, and constrained DeepSeek analysis.<n>On 450 NFT contract samples, the full configuration produced 437 positive labels, corresponding to a reported positive-label rate of 97.1%.<n>Removing the external knowledge base reduced this rate to 87.11%, while analyzing complete contracts without the knowledge base reduced it to 73.78%.
  arXiv  Detail & Related papers  (2026-07-24T05:10:26Z)
• SCDBench: A Benchmark for LLM-Based Smart Contract Decompilers [55.39407031861402]
  We introduce SCDBench, a dataset and benchmark methodology for smart contract decompilation.<n>The dataset contains 600 real-world Solidity contracts with paired bytecode inputs, ground-truth source code, and replayable semantic checkpoints.<n>We evaluate Claude Opus 4.7, GPT-5.3-Codex, and GLM-5 in a zero-shot decompilation setting, including GLM-5 variants with and without extended reasoning.
  arXiv  Detail & Related papers  (2026-05-27T20:08:47Z)
• V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution [52.57923394143007]
  V2E is a new framework for validating whether a reported vulnerability is truly exploitable.<n>V2E automatically generates Proof-of-Concept (PoC) and then assess if the vulnerability could be triggered and incur any financial loss.<n> Evaluation on 264 manually labeled contracts shows that V2E outperforms the baseline approach.
  arXiv  Detail & Related papers  (2026-04-15T08:24:24Z)
• One Signature, Multiple Payments: Demystifying and Detecting Signature Replay Vulnerabilities in Smart Contracts [56.94148977064169]
  lacking checks on signature usage conditions can lead to repeated verifications, increasing the risk of permission abuse and threatening contract assets.<n>We define this issue as the Signature Replay Vulnerability (SRV)<n>From 1,419 audit reports across 37 blockchain security companies, we identified 108 with detailed SRV descriptions and classified five types of SRVs.
  arXiv  Detail & Related papers  (2025-11-12T09:17:13Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• ICVul: A Well-labeled C/C++ Vulnerability Dataset with Comprehensive Metadata and VCCs [3.15997226620249]
  Machine learning-based software vulnerability detection requires high-quality datasets.<n>We constructed ICVul, a dataset emphasizing data quality and enriched with comprehensive metadata.<n>The dataset is stored in a relational-like database for improved usability and data integrity.
  arXiv  Detail & Related papers  (2025-05-13T12:33:51Z)
• DREW : Towards Robust Data Provenance by Leveraging Error-Controlled Watermarking [58.37644304554906]
  We propose Data Retrieval with Error-corrected codes and Watermarking (DREW) DREW randomly clusters the reference dataset and injects unique error-controlled watermark keys into each cluster. After locating the relevant cluster, embedding vector similarity retrieval is performed within the cluster to find the most accurate matches.
  arXiv  Detail & Related papers  (2024-06-05T01:19:44Z)
• CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Software [0.0]
  We implement a fully automated dataset collection tool and share an initial release of the resulting vulnerability dataset named CVEfixes. The dataset is enriched with meta-data such as programming language, and detailed code and security metrics at five levels of abstraction. CVEfixes supports various types of data-driven software security research, such as vulnerability prediction, vulnerability classification, vulnerability severity prediction, analysis of vulnerability-related code changes, and automated vulnerability repair.
  arXiv  Detail & Related papers  (2021-07-19T11:34:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.