UEChecker: Detecting Unchecked External Call Vulnerabilities in DApps via Graph Analysis

TL;DR

UEChecker is a deep learning tool that uses graph analysis and advanced neural network modules to detect unchecked external call vulnerabilities in DApps, significantly improving detection accuracy over existing methods.

Contribution

This paper introduces UEChecker, a novel deep learning-based approach combining call graph analysis and advanced neural modules for vulnerability detection in smart contracts.

Findings

Achieves 87.59% accuracy in detecting vulnerabilities

Outperforms GAT, LSTM, and GCN baselines

Effectively captures multi-scale dependencies in call graphs

Abstract

The increasing number of attacks on the contract layer of DApps has resulted in economic losses amounting to $66 billion. Vulnerabilities arise when contracts interact with external protocols without verifying the results of the calls, leading to exploit entry points such as flash loan attacks and reentrancy attacks. In this paper, we propose UEChecker, a deep learning-based tool that utilizes a call graph and a Graph Convolutional Network to detect unchecked external call vulnerabilities. We design the following components: An edge prediction module that reconstructs the feature representation of nodes and edges in the call graph; A node aggregation module that captures structural information from both the node itself and its neighbors, thereby enhancing feature representation between nodes and improving the model's understanding of the global graph structure; A Conformer Block module that integrates multi-head attention, convolutional modules, and feedforward neural networks to more effectively capture dependencies of different scales within the call graph, extending beyond immediate neighbors and enhancing the performance of vulnerability detection. Finally, we combine these modules with Graph Convolutional Network to detect unchecked external call vulnerabilities. By auditing the smart contracts of 608 DApps, our results show that our tool achieves an accuracy of 87.59% in detecting unchecked external call vulnerabilities. Furthermore, we compare our tool with GAT, LSTM, and GCN baselines, and in the comparison experiments, UEChecker consistently outperforms these models in terms of accuracy.