Esim: EVM Bytecode Similarity Detection Based on Stable-Semantic Graph

TL;DR

This paper introduces Esim, a novel method for detecting EVM bytecode similarity using a stable-semantic graph representation and graph neural networks, significantly improving accuracy over traditional methods.

Contribution

The paper proposes the Stable-Semantic Graph (SSG) representation and implements Esim, a tool that achieves high accuracy in EVM bytecode similarity detection and outperforms existing tools.

Findings

Achieves 100% F1-score for control flow similarity

Reaches 96.3% AUC in similarity detection

Outperforms Etherscan in vulnerability search on large-scale data

Abstract

Decentralized finance (DeFi) is experiencing rapid expansion. However, prevalent code reuse and limited open-source contributions have introduced significant challenges to the blockchain ecosystem, including plagiarism and the propagation of vulnerable code. Consequently, an effective and accurate similarity detection method for EVM bytecode is urgently needed to identify similar contracts. Traditional binary similarity detection methods are typically based on instruction stream or control flow graph (CFG), which have limitations on EVM bytecode due to specific features like low-level EVM bytecode and heavily-reused basic blocks. Moreover, the highly-diverse Solidity Compiler (Solc) versions further complicate accurate similarity detection. Motivated by these challenges, we propose a novel EVM bytecode representation called Stable-Semantic Graph (SSG), which captures relationships between 'stable instructions' (special instructions identified by our study). Moreover, we implement a prototype, Esim, which embeds SSG into matrices for similarity detection using a heterogeneous graph neural network. Esim demonstrates high accuracy in SSG construction, achieving F1-scores of 100% for control flow and 95.16% for data flow, and its similarity detection performance reaches 96.3% AUC, surpassing traditional approaches. Our large-scale study, analyzing 2,675,573 smart contracts on six EVM-compatible chains over a one-year period, also demonstrates that Esim outperforms the SOTA tool Etherscan in vulnerability search.