journal article·2025-05-24Open access

Smart Contract Security in Decentralized Finance: Enhancing Vulnerability Detection with Reinforcement Learning

Jose Juan de Leon, Cenchuan Zhang, Christos-Spyridon Koulouris, Francesca Medda, Rahul

Applied Sciences· Volume 15· Issue 11

Abstract

The growing interest in decentralized finance (DeFi), driven by advancements in blockchain technologies such as Ethereum, highlights the crucial role of smart contracts. However, the inherent openness of blockchains creates an extensive attack surface, exposing participants’ funds to undetected security flaws. In this work we investigated the use of deep reinforcement learning techniques, specifically Deep Q-Network (DQN) and Proximal Policy Optimization (PPO), for detecting and classifying vulnerabilities in smart contracts. This approach utilizes control flow graphs (CFGs) generated through EtherSolve to capture the semantic features of contract bytecode, enabling the reinforcement learning models to recognize patterns and make more accurate predictions. Experimental results from extensive public datasets of smart contracts revealed that the PPO model performs better than DQN and demonstrates effectiveness in identifying unchecked-call vulnerability. The PPO model exhibits more stable and consistent learning patterns and achieves higher overall rewards. This research introduces a machine learning method for enhancing smart contract security, reducing financial risks for users, and contributing to future developments in reinforcement learning applications.
Source: crossref · Quality: baseline

Research context

OpenAlex topics: Blockchain Technology Applications and Security · FinTech, Crowdfunding, Digital Finance · Crime, Illicit Activities, and Governance

SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.

Affiliations

Institute of Finance and Technology, University College London, London WC1E 6BT, UK

Honda R&D Europe (UK) Ltd., Reading RG7 4SA, UK

References (40)

Show source-provided references
1. Ethereum: A Secure Decentralized Generalised Transaction Ledger
2. A Risk Assessment Method for Decentralized Finance(DeFi) with Fermatean Fuzzy AHP Approach
3. De Baets, C., Suleiman, B., Chitizadeh, A., and Razzak, I. (2024). Vulnerability Detection in Smart Contracts: A Comprehensive Survey. arXiv.
4. Understanding a revolutionary and flawed grand experiment in blockchain: The DAO attack10.4018/JCIT.2019010102 ↗
5. Breidenbach, L., Daian, P., Juels, A., and Sirer, E.G. (2017). An in-depth look at the parity multisig bug. Hacking.
6. (2025, March 15). Explained: The BNB Chain Hack. Available online: https://www.halborn.com/blog/post/explained-the-bnb-chain-hack-october-2022.
7. (2025, March 12). SlowMist. Available online: https://hacked.slowmist.io/.
8. A detection model for false data injection attacks in smart grids based on graph spatial features using temporal convolutional neural networks10.1016/j.epsr.2024.111126 ↗
9. Al-Harbi, H. (2025). Detecting Anomalies in Blockchain Transactions Using Spatial-Temporal Graph Neural Networks. Adv. Mach. Intell. Technol., 1.10.62177/amit.v1i1.200 ↗
10. Thiruloga, S., Kukkala, V.K., and Pasricha, S. (2022, January 5). TENET: Temporal CNN with Attention for Anomaly Detection in Automotive Cyber-Physical Systems. Proceedings of the 2022 Asia and South Pacific Design Automation Conference (ASP-DAC), Taipei, Taiwan.10.1109/ASP-DAC52403.2022.9712524 ↗
11. Monitoring industrial control systems via spatio-temporal graph neural networks10.1016/j.engappai.2023.106144 ↗
12. Detecting functional and security-related issues in smart contracts: A systematic literature review10.1002/spe.3156 ↗
13. Luu, L., Chu, D.H., Olickel, H., Saxena, P., and Hobor, A. (2016, January 24). Making smart contracts smarter. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.10.1145/2976749.2978309 ↗
14. Prechtel, D., Groß, T., and Müller, T. (2019, January 24–26). Evaluating Spread of ‘Gasless Send’ in Ethereum Smart Contracts. Proceedings of the 2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS), Canary Islands, Spain.10.1109/NTMS.2019.8763848 ↗
15. Tsankov, P., Dan, A., Drachsler-Cohen, D., Gervais, A., Bünzli, F., and Vechev, M. (2018, January 15–19). Securify: Practical Security Analysis of Smart Contracts. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.10.1145/3243734.3243780 ↗
16. Tikhomirov, S., Voskresenskaya, E., Ivanitskiy, I., Takhaviev, R., Marchenko, E., and Alexandrov, Y. (2018, January 27). SmartCheck: Static analysis of ethereum smart contracts. Proceedings of the 1st International Workshop on Emerging Trends in Software Engineering for Blockchain, Gothenburg, Sweden.10.1145/3194113.3194115 ↗
17. Feist, J., Grieco, G., and Groce, A. (2019, January 27). Slither: A Static Analysis Framework For Smart Contracts. Proceedings of the 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB), Montreal, QC, Canada.10.1109/WETSEB.2019.00008 ↗
18. ReDefender: Detecting Reentrancy Vulnerabilities in Smart Contracts Automatically10.1109/TR.2022.3161634 ↗
19. Torres, C.F., Iannillo, A.K., Gervais, A., and State, R. (2021, January 6–10). ConFuzzius: A Data Dependency-Aware Hybrid Fuzzer for Smart Contracts. Proceedings of the 2021 IEEE European Symposium on Security and Privacy (EuroS&P), Vienna, Austria.10.1109/EuroSP51992.2021.00018 ↗
20. Li, J., Lu, G., Gao, Y., and Gao, F. (2023). A Smart Contract Vulnerability Detection Method Based on Multimodal Feature Fusion and Deep Learning. Mathematics, 11.10.3390/math11234823 ↗
21. Gao, Z., Jayasundara, V., Jiang, L., Xia, X., Lo, D., and Grundy, J. (2019, January 29). SmartEmbed: A Tool for Clone and Bug Detection in Smart Contracts through Structural Code Embedding. Proceedings of the 2019 IEEE International Conference on Software Maintenance and Evolution (ICSME), Cleveland, OH, USA.10.1109/ICSME.2019.00067 ↗
22. Hao, X., Ren, W., Zheng, W., and Zhu, T. (2020, January 29). SCScan: A SVM-Based Scanning System for Vulnerabilities in Blockchain Smart Contracts. Proceedings of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Guangzhou, China.10.1109/TrustCom50675.2020.00221 ↗
23. Zhang, Y., Kang, S., Dai, W., Chen, S., and Zhu, J. (2021, January 5–10). Code Will Speak: Early detection of Ponzi Smart Contracts on Ethereum. Proceedings of the 2021 IEEE International Conference on Services Computing (SCC), Chicago, IL, USA.10.1109/SCC53864.2021.00043 ↗
24. Towards Automated Reentrancy Detection for Smart Contracts Based on Sequential Models10.1109/ACCESS.2020.2969429 ↗
25. Xu, G., Liu, L., and Zhou, Z. (2022, January 15–17). Reentrancy Vulnerability Detection of Smart Contract Based on Bidirectional Sequential Neural Network with Hierarchical Attention Mechanism. Proceedings of the 2022 International Conference on Blockchain Technology and Information Security (ICBCTIS), Huaihua, China.10.1109/ICBCTIS55569.2022.00024 ↗
26. CodeNet: Code-Targeted Convolutional Neural Network Architecture for Smart Contract Vulnerability Detection10.1109/ACCESS.2022.3162065 ↗
27. Combine sliced joint graph with graph neural networks for smart contract vulnerability detection10.1016/j.jss.2022.111550 ↗
28. ASSBert: Active and semi-supervised bert for smart contract vulnerability detection
29. Enhancing smart contract security: Leveraging pre-trained language models for advanced vulnerability detection10.1049/blc2.12072 ↗
30. Andrijasa, M.F., Ismail, S.A., and Ahmad, N. (2022, January 14–16). Towards Automatic Exploit Generation for Identifying Re-Entrancy Attacks on Cross-Contract. Proceedings of the 2022 IEEE Symposium on Future Telecommunication Technologies (SOFTT), Johor Baharu, Malaysia.10.1109/SOFTT56880.2022.10010192 ↗
31. Su, J., Dai, H.N., Zhao, L., Zheng, Z., and Luo, X. (2023, January 5). Effectively Generating Vulnerable Transaction Sequences in Smart Contracts with Reinforcement Learning-guided Fuzzing. Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, Rochester, MI, USA.10.1145/3551349.3560429 ↗
32. Rossini, M., Zichichi, M., and Ferretti, S. (2023, January 11–13). On the Use of Deep Neural Networks for Security Vulnerabilities Detection in Smart Contracts. Proceedings of the 2023 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops), Atlanta, GA, USA.10.1109/PerComWorkshops56833.2023.10150302 ↗
33. (2024, July 14). Slither-Audited-Smart-Contracts. Available online: https://huggingface.co/datasets/mwritescode/slither-audited-smart-contracts.
34. (2024, August 12). Etherscan. Available online: https://docs.etherscan.io/.
35. Contro, F., Crosara, M., Ceccato, M., and Preda, M.D. (2021). EtherSolve: Computing an Accurate Control-Flow Graph from Ethereum Bytecode. arXiv.10.1109/ICPC52881.2021.00021 ↗
36. (2024, August 15). EtherSolve. Available online: https://github.com/SeUniVr/EtherSolve/blob/main/artifact/EtherSolve.jar.
37. Human-level control through deep reinforcement learning10.1038/nature14236 ↗
38. (2024, August 15). RPS: RL Using Deep Q Network (DQN). Available online: https://www.kaggle.com/code/anmolkapoor/rps-rl-using-deep-q-network-dqn#Deep-Q-Network-(DQN).
39. Schulman, J., Wolski, F., Dhariwal, P., Radford, A., and Klimov, O. (2017). Proximal Policy Optimization Algorithms. arXiv.
40. (2024, August 15). Proximal Policy Optimization. Available online: https://spinningup.openai.com/en/latest/algorithms/ppo.html.