Combining GPT and Code-Based Similarity Checking for Effective Smart Contract Vulnerability Detection

TL;DR

This paper introduces SimilarGPT, a novel tool combining GPT models with code similarity checks to improve vulnerability detection in smart contracts, achieving higher accuracy and fewer false positives.

Contribution

The paper presents a new approach that integrates LLMs with code similarity techniques for smart contract security, enhancing detection effectiveness.

Findings

Improved vulnerability detection accuracy.

Reduced false positives in security audits.

Effective identification of missed vulnerabilities.

Abstract

With the rapid growth of blockchain technology, smart contracts are now crucial to Decentralized Finance (DeFi) applications. Effective vulnerability detection is vital for securing these contracts against hackers and enhancing the accuracy and efficiency of security audits. In this paper, we present SimilarGPT, a unique vulnerability identification tool for smart contract, which combines Generative Pretrained Transformer (GPT) models with Code-based similarity checking methods. The main concept of the SimilarGPT tool is to measure the similarity between the code under inspection and the secure code from third-party libraries. To identify potential vulnerabilities, we connect the semantic understanding capability of large language models (LLMs) with Code-based similarity checking techniques. We propose optimizing the detection sequence using topological ordering to enhance logical coherence and reduce false positives during detection. Through analysis of code reuse patterns in smart contracts, we compile and process extensive third-party library code to establish a comprehensive reference codebase. Then, we utilize LLM to conduct an indepth analysis of similar codes to identify and explain potential vulnerabilities in the codes. The experimental findings indicate that SimilarGPT excels in detecting vulnerabilities in smart contracts, particularly in missed detections and minimizing false positives.