Esim: EVM Bytecode Similarity Detection Based on Stable-Semantic Graph

2025-11-16

AI Summary

Traditional bytecode similarity detection methods—such as those based on instruction sequences or control-flow graphs (CFGs)—suffer from reduced accuracy on EVM bytecode due to compiler-version variability and pervasive basic-block reuse. Method: This paper proposes Stable Semantic Graphs (SSGs), a robust intermediate representation constructed via static analysis that jointly encodes control- and data-flow semantics, thereby suppressing compiler-induced noise; complemented by a heterogeneous graph neural network (GNN) framework for learning graph embeddings and computing semantic similarity. Contribution/Results: SSG construction achieves 100% F1-score on control-flow recovery and 95.16% on data-flow recovery. In cross-chain smart contract similarity detection, the approach attains an AUC of 96.3%, significantly outperforming state-of-the-art tools (e.g., Etherscan) on a benchmark of over 2.67 million contracts across six EVM-compatible blockchains. The method enables high-precision, cross-version identification of code cloning and vulnerability propagation in DeFi applications.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community
• Search and Optimization: Evolutionary Computation

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Web query analysis, representation and understanding

Abstract

Decentralized finance (DeFi) is experiencing rapid expansion. However, prevalent code reuse and limited open-source contributions have introduced significant challenges to the blockchain ecosystem, including plagiarism and the propagation of vulnerable code. Consequently, an effective and accurate similarity detection method for EVM bytecode is urgently needed to identify similar contracts. Traditional binary similarity detection methods are typically based on instruction stream or control flow graph (CFG), which have limitations on EVM bytecode due to specific features like low-level EVM bytecode and heavily-reused basic blocks. Moreover, the highly-diverse Solidity Compiler (Solc) versions further complicate accurate similarity detection. Motivated by these challenges, we propose a novel EVM bytecode representation called Stable-Semantic Graph (SSG), which captures relationships between 'stable instructions' (special instructions identified by our study). Moreover, we implement a prototype, Esim, which embeds SSG into matrices for similarity detection using a heterogeneous graph neural network. Esim demonstrates high accuracy in SSG construction, achieving F1-scores of 100% for control flow and 95.16% for data flow, and its similarity detection performance reaches 96.3% AUC, surpassing traditional approaches. Our large-scale study, analyzing 2,675,573 smart contracts on six EVM-compatible chains over a one-year period, also demonstrates that Esim outperforms the SOTA tool Etherscan in vulnerability search.

Problem

• Detecting EVM bytecode similarity to combat plagiarism and vulnerable code propagation
• Overcoming limitations of traditional binary detection methods on low-level bytecode
• Addressing accuracy challenges caused by diverse Solidity compiler versions

Innovation

• Stable-Semantic Graph represents EVM bytecode relationships
• Heterogeneous graph neural network embeds SSG for detection
• Esim prototype achieves high accuracy in similarity detection