BugSweeper: Function-Level Detection of Smart Contract Vulnerabilities Using Graph Neural Networks

The rapid growth of Ethereum has made it more important to quickly and accurately detect smart contract vulnerabilities. While machine learning–based methods have shown some promises, many still rely on rule-based preprocessing designed by domain experts. Such rule-based preprocessing methods often discard crucial context from the source code, potentially causing certain vulnerabilities to be overlooked and limiting adaptability to newly emerging threats. We introduce \textit{BugSweeper}, an end-to-end deep learning framework that detects vulnerabilities directly from the source code without manual engineering. BugSweeper represents each Solidity function as a function-level abstract syntax graph (FLAG), a novel graph structure that combines its abstract syntax tree (AST) with enriched control-flow and data-flow semantics. Then, our two-stage graph neural network model analyzes these graphs. The first-stage GNN filters noise from syntax graphs, while the second-stage GNN conducts high-level reasoning to detect diverse vulnerabilities. Extensive experiments on real-world contracts show that BugSweeper significantly outperforms all state-of-the-art detection methods. By removing the need for handcrafted rules, our approach offers a robust, automated, and scalable solution for securing smart contracts without any dependence on security experts.