Zero-Shot Vulnerability Detection in Low-Resource Smart Contracts Through Solidity-Only Training

1. Problem Statement

Smart contract vulnerabilities pose severe financial risks, yet existing detection methods face a critical bottleneck in low-resource languages like Vyper.

• Data Scarcity: While Solidity (the dominant Ethereum language) has abundant labeled vulnerability datasets, Vyper lacks sufficient labeled samples due to its relative novelty and smaller ecosystem.
• Limitations of Current Tools: Traditional static analysis tools (e.g., Slither, Mythril) rely on manually crafted patterns that often fail to generalize across languages or suffer from high false-positive rates. Deep learning models require large labeled datasets, which are unavailable for Vyper.
• The Gap: There is no effective deep learning-based method to detect vulnerabilities in Vyper without extensive labeled training data, creating a security gap in the blockchain ecosystem.

2. Methodology: The Sol2Vy Framework

The authors propose Sol2Vy, a novel framework that enables zero-shot vulnerability detection in Vyper by training exclusively on Solidity. The core insight is to leverage SlithIR (a language-agnostic Intermediate Representation) and a three-stage transfer learning pipeline.

A. Intermediate Representation (IR)

• SlithIR: Both Solidity and Vyper source codes are lifted to SlithIR using the Slither tool. This abstracts away syntactic differences (e.g., Pythonic syntax in Vyper vs. C-like in Solidity) into a standardized three-address code format.
• Challenge: Even in SlithIR, semantic differences persist due to compiler-specific optimizations and language constructs (e.g., modifiers).
• Solution: The framework uses an unsupervised alignment step to bridge the distributional gap between Solidity and Vyper IRs.

B. Three-Stage Pipeline

1. Unsupervised Transferable Knowledge Learning (Stage 1):

   • Input: Large, unlabeled datasets of both Solidity and Vyper contracts.
   • Architecture: A Multi-View Encoder consisting of:
     • Sequential Encoder: A Transformer-based model to capture temporal dependencies and instruction flows.
     • Hierarchical Encoder: A Graph Attention Network (GAT) processing the AST-derived graph to capture structural relationships (data flow, control flow).
   • Objective: Minimize the Maximum Mean Discrepancy (MMD) loss between the feature distributions of Solidity and Vyper. This forces the model to learn language-agnostic semantic representations without needing labels.

2. Supervised Vulnerability Detection on Solidity (Stage 2):

   • Input: Labeled Solidity contracts (Safe vs. Vulnerable).
   • Process: The pre-trained multi-view encoders are frozen to preserve the learned language-agnostic knowledge. A classification network (MLP) is added on top and trained only on Solidity vulnerability labels.
   • Goal: Learn vulnerability-specific patterns (Reentrancy, Weak Randomness, Unchecked Transfer) within the aligned feature space.

3. Zero-Shot Testing on Vyper (Stage 3):

   • Process: The trained model (frozen encoders + Solidity-trained classifier) is applied directly to Vyper contracts.
   • Outcome: No Vyper labeled data is required for training or fine-tuning. The model detects vulnerabilities based on the semantic alignment learned in Stage 1.

3. Key Contributions

• First Zero-Shot Vyper Detector: Sol2Vy is the first framework to enable deep learning-based vulnerability detection for Vyper without any labeled Vyper training data.
• Novel Multi-View Architecture: It combines sequential (Transformer) and hierarchical (GAT) encoders to capture both instruction flow and structural semantics, providing richer semantic coverage than single-view approaches.
• Effective Cross-Language Alignment: By utilizing MMD loss on SlithIR, the framework successfully bridges the syntactic and semantic gaps between Solidity and Vyper, allowing a Solidity-trained model to generalize to Vyper.
• Comprehensive Evaluation: The study covers three critical vulnerability types: Reentrancy (RE), Weak Randomness (WR), and Unchecked Transfer (UT).

4. Experimental Results

The authors evaluated Sol2Vy against traditional tools, deep learning baselines, and LLMs.

• Performance Metrics (FPR/FNR):

  • Solidity (Train/Test): 0.09/0.13 (RE), 0.08/0.12 (WR), 0.11/0.14 (UT).
  • Vyper (Zero-Shot): 0.11/0.16 (RE), 0.10/0.15 (WR), 0.12/0.17 (UT).
  • Observation: The performance drop when moving from Solidity to Vyper is minimal (approx. 0.02–0.03 increase in error rates), demonstrating strong transferability.

• Comparison with Baselines:

  • vs. Static/Dynamic Tools: Sol2Vy significantly outperforms Slither (FPR ~0.46) and Mythril (FPR ~0.38).
  • vs. Deep Learning Baselines: It outperforms models trained directly on Vyper (which suffer from data scarcity) and pre-trained code models like CodeT5+ and GraphCodeBERT.
  • vs. LLMs: Sol2Vy (FPR ~0.11) significantly outperforms prompting-based LLMs (GPT-4, CodeLlama), which struggle with structural vulnerability detection in Vyper.

• Ablation Studies:

  • Removing either the sequential or hierarchical encoder degrades performance, confirming their complementary roles.
  • Freezing encoders is crucial; joint training (fine-tuning encoders on Solidity) leads to catastrophic performance loss (FPR > 0.6), proving that preserving the language-agnostic representation is key.

• Efficiency:

  • Sol2Vy is orders of magnitude faster than dynamic analysis (Mythril) and competitive with static analysis (Slither).
  • Average runtime: ~0.28s (Small contracts) vs. 24.3s for Mythril.

5. Significance

• Bridging the Security Gap: Sol2Vy addresses the critical lack of security tools for emerging smart contract languages, ensuring that Vyper contracts are not left vulnerable due to a lack of labeled data.
• Paradigm Shift: It demonstrates that cross-language transfer learning via language-agnostic IRs is a viable and superior strategy for low-resource domains, moving beyond the reliance on massive, language-specific labeled datasets.
• Practical Applicability: The framework offers a high-accuracy, low-latency solution suitable for automated scanning pipelines in DeFi and DAOs, reducing the risk of financial loss from undetected vulnerabilities.

In conclusion, Sol2Vy successfully proves that a model trained solely on the dominant language (Solidity) can effectively detect vulnerabilities in a low-resource language (Vyper) by learning shared semantic representations, setting a new standard for cross-language smart contract security analysis.