[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-151073-en":3,"doc-seo-151073-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},151073,137441390410,"Hazel","https://ap-avatar.wpscdn.com/avatar/2000252f4ab5702993?_k=1776741390130283984",8,"Research & Report","DAppSCAN - Building Large-Scale Datasets for Smart Contract Weaknesses in DApp Projects","DAppSCAN targets the evaluation gap in smart contract weakness detection by constructing large-scale datasets grounded in real-world decentralized applications. It leverages the SWC Registry, extracting weaknesses from 1,199 open-source audit reports produced by 29 security teams. With 22 participants and 44 person-months of analysis, the work produces two datasets: DAPPSCAN-SOURCE and DAPPSCAN-BYTECODE, enabling dependency completion for compilable bytecode. Empirical testing on DAPPSCAN-BYTECODE shows state-of-the-art tools underperform in both effectiveness and success detection rate, motivating future efforts to prioritize realistic datasets over toy contracts.","arXiv :2305 .08456v3 [ cs . SE] 19 Sep 2024  \nIEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL.50, NO.6, JUNE 2024 1  \nDAppSCAN: Building Large-Scale Datasets for Smart Contract Weaknesses in DApp Projects  \nZibin Zheng, Jianzhong Su, Jiachi Chen, David Lo, Zhijie Zhong and Mingxi Ye  \nAbstract—The Smart Contract Weakness Classification Registry (SWC Registry) is a widely recognized list of smart contract  \nweaknesses specific to the Ethereum platform. Despite the SWC Registry not being updated with new entries since 2020, the sustained development of smart contract analysis tools for detecting SWC-listed weaknesses highlights their ongoing significance in the field. However, evaluating these tools has proven challenging due to the absence of a large, unbiased, real-world dataset. To address this problem, we aim to build a large-scale SWC weakness dataset from real-world DApp projects. We recruited 22 participants and spent 44 person-months analyzing 1,199 open-source audit reports from 29 security teams. In total, we identified 9,154 weaknesses and developed two distinct datasets, i.e., DAPPSCAN-SOURCE and DAPPSCAN-BYTECODE. The DAPPSCAN-SOURCE dataset comprises 39,904 Solidity files, featuring 1,618 SWC weaknesses sourced from 682 real-world DApp projects. However, the Solidity files in this dataset may not be directly compilable for further analysis. To facilitate automated analysis, we developed a tool capable of automatically identifying dependency relationships within DApp projects and completing missing public libraries. Using this tool, we created DAPPSCAN-BYTECODE dataset, which consists of 6,665 compiled smart contract with 888 SWC weaknesses. Based on DAPPSCAN-BYTECODE, we conducted an empirical study to evaluate the performance of state-of-the-art smart contract weakness detection tools. The evaluation results revealed sub-par performance for these tools in terms of both effectiveness and success  \ndetection rate, indicating that future development should prioritize real-world datasets over simplistic toy contracts.  \nIndex Terms—Empirical Study, Smart Contracts, SWC Weakness, Dataset, Ethereum  \n~~ ~~ ✦ ~~ ~~  \n1 INTRODUCTION  \nIn 2015, Ethereum [1] introduced a revolutionary technology named smart contracts [2] . Smart contracts can be regarded as Turing-complete programs deployed on the blockchain. By utilizing smart contracts, developers can easily develop their decentralized applications (DApp) . DApps are immutable, self-executed, without a centralized architecture, which guarantees the transparency and trustworthiness of DApps. These features make smart contracts widely used in many areas, e.g., finance [3] and gaming [4] .  \nUnfortunately, a large number of security incidents related to Ethereum smart contracts have occurred and have caused billions of dollars in financial losses [5] in recent years. To increase the security of smart contracts, significant effort has been devoted to identifying and detecting security issues in smart contracts. For example, Chen et al. [6] introduced 20 kinds of smart contract defect by analyzing online Q&A posts. The DASP project [7] is a smart contract taxonomy that reports on 10 vulnerabilities. A notable blockchain security team named ConsenSys [8] summarized several common smart contract problems and provided a repository named the Smart Contract Weakness Classification Registry (SWC Registry [9]) . There are 37 kinds of weaknesses in the SWC Registry as of April 2023 . Based  \n• Zibin Zheng, Jiachi Chen, Jianzhong Su, Zhijie Zhong and Mingxi Ye are with School of Software Engineering, Sun Yat-sen University, China. E-mail: {zhzibin, [chenjch86](chenjch86}@mail.sysu.edu.cn)[}](chenjch86}@mail.sysu.edu.cn)[@mail.sysu.edu.cn](chenjch86}@mail.sysu.edu.cn)[ ](chenjch86}@mail.sysu.edu.cn)E-mail: {sujzh3, zhongzhj3, [yemx6](yemx6}@mail2.sysu.edu.cn)[}](yemx6}@mail2.sysu.edu.cn)[@mail2.sysu.edu.cn](yemx6}@mail2.sysu.edu.cn)  \n• David Lo is with the School of Information Systems,","cbCainRMMfOhIKj5","https://ap.wps.com/l/cbCainRMMfOhIKj5","pdf",638130,1,14,"English","en",105,"# Introduction\n## Smart contract and DApp background\n## Motivation: security incidents and tool evaluation challenges\n## Related weakness taxonomies and analysis tools\n## Common evaluation methods and their limitations","[{\"question\":\"Why is building a real-world labeled dataset important for smart contract weakness detection tools?\",\"answer\":\"Tool evaluation is difficult because there is a lack of large, unbiased, real-world datasets. Existing studies often rely on small manually labeled sets or tool-applied large sets that still suffer from representativeness and evaluation coverage limits.\"},{\"question\":\"How does DAppSCAN create its two datasets?\",\"answer\":\"DAppSCAN first analyzes 1,199 open-source audit reports to build DAPPSCAN-SOURCE from Solidity files. Because these files may not compile directly, it also develops a tool to infer dependencies and complete missing public libraries, producing DAPPSCAN-BYTECODE with compiled smart contracts.\"},{\"question\":\"What do the empirical results indicate about current weakness detection tools?\",\"answer\":\"Experiments based on DAPPSCAN-BYTECODE show sub-par performance in effectiveness and success detection rate. The findings suggest prioritizing realistic real-world datasets rather than simplistic toy contracts for future tool development.\"}]","DAppSCAN - Building Large-Scale Datasets for Smart Contract Weaknesses in DApp Projects | PDF",1787832345,35,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"dappscan-building-large-scale-datasets-for-smart-contract-weaknesses-in-dapp-projects","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/dappscan-building-large-scale-datasets-for-smart-contract-weaknesses-in-dapp-projects/151073/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-09-04","2026-08-27",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"Why is building a real-world labeled dataset important for smart contract weakness detection tools?","Question",{"text":76,"@type":77},"Tool evaluation is difficult because there is a lack of large, unbiased, real-world datasets. Existing studies often rely on small manually labeled sets or tool-applied large sets that still suffer from representativeness and evaluation coverage limits.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How does DAppSCAN create its two datasets?",{"text":81,"@type":77},"DAppSCAN first analyzes 1,199 open-source audit reports to build DAPPSCAN-SOURCE from Solidity files. Because these files may not compile directly, it also develops a tool to infer dependencies and complete missing public libraries, producing DAPPSCAN-BYTECODE with compiled smart contracts.",{"name":83,"@type":74,"acceptedAnswer":84},"What do the empirical results indicate about current weakness detection tools?",{"text":85,"@type":77},"Experiments based on DAPPSCAN-BYTECODE show sub-par performance in effectiveness and success detection rate. The findings suggest prioritizing realistic real-world datasets rather than simplistic toy contracts for future tool development.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,121,124,129,132,136],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":46,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":46,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":46,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":46,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":46,"category_name":138,"show_sort_weight":107,"slug":139},19,"General","general"]