Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations

2026-09-01

AI Summary

该研究通过自动化方法收集并整理了至2026年7月的以太坊智能合约CVE记录，提供了一个包含漏洞代码、标签及位置的数据集，支持安全研究和代码分析。

Abstract

The Common Vulnerabilities and Exposures (CVE) database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated dataset of CVE records up to July 2026 referring to Ethereum smart contracts. The dataset contains the vulnerable artifacts (source code and runtime bytecode), labels according to three taxonomies, and function-level locations. The retrieval of CVE records, collection of additional evidence, validation of the correspondence between records and artifacts, label assignment, and vulnerability localization are automated, leaving 15% to manual analysis. The dataset does not validate the original vulnerability claims, but marks a few records obviously wrong as `refuted'. For the sake of reproducibility, all external inputs are retained, so that rerunning the pipelines results in the same outputs. The dataset comprises 491 records linked to deployed contracts, 26 referring to projects (mostly libraries), 45 without validated artifacts, and six records with refuted claims. The dataset supports empirical security research, in particular the evaluation of code analysis and repair techniques.

Problem

• Smart Contracts
• Vulnerabilities
• CVE Database
• Ethereum

Innovation

• CVE-Smart-Contracts
• automated processing
• reproducibility
• vulnerability localization