Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

TaintSentinel: Path-Level Randomness Vulnerability Detection for Ethereum Smart Contracts

Hadis Rezaei, Ahmed Afif Monrat, Karl Andersson, Francesco Flammini

TL;DR

This work addresses the challenge of generating secure randomness in Ethereum smart contracts by modeling bad randomness as a path-sensitive vulnerability. It introduces TaintSentinel, a two-phase framework that combines context-aware taint analysis with a dual-stream GNN (PathFocused and GlobalContext streams) and an adaptive fusion gate to detect and rank vulnerability paths. Key contributions include path-level vulnerability extraction, rule-augmented taint analysis to reduce false positives, and the PathGNN/GlobalGCN architecture with a novel Path Risk Accuracy metric. On 4,844 contracts, TaintSentinel achieves a high F1 of $0.892$, AUC-ROC of $0.94$–$0.951$, and PRA of $0.97$, significantly outperforming existing tools and enabling production-grade security auditing with scalable inference times.

Abstract

The inherent determinism of blockchain technology poses a significant challenge to generating secure random numbers within smart contracts, leading to exploitable vulnerabilities, particularly in decentralized finance (DeFi) ecosystems and blockchain-based gaming applications. From our observations, the current state-of-the-art detection tools suffer from inadequate precision while dealing with random number vulnerabilities. To address this problem, we propose TaintSentinel, a novel path sensitive vulnerability detection system designed to analyze smart contracts at the execution path level and gradually analyze taint with domain-specific rules. This paper discusses a solution that incorporates a multi-faceted approach, integrating rule-based taint analysis to track data flow, a dual stream neural network to identify complex vulnerability signatures, and evidence-based parameter initialization to minimize false positives. The system's two-phase operation involves semantic graph construction and taint propagation analysis, followed by pattern recognition using PathGNN and global structural analysis via GlobalGCN. Our experiments on 4,844 contracts demonstrate the superior performance of TaintSentinel relative to existing tools, yielding an F1-score of 0.892, an AUC-ROC of 0.94, and a PRA accuracy of 97%.

TaintSentinel: Path-Level Randomness Vulnerability Detection for Ethereum Smart Contracts

TL;DR

This work addresses the challenge of generating secure randomness in Ethereum smart contracts by modeling bad randomness as a path-sensitive vulnerability. It introduces TaintSentinel, a two-phase framework that combines context-aware taint analysis with a dual-stream GNN (PathFocused and GlobalContext streams) and an adaptive fusion gate to detect and rank vulnerability paths. Key contributions include path-level vulnerability extraction, rule-augmented taint analysis to reduce false positives, and the PathGNN/GlobalGCN architecture with a novel Path Risk Accuracy metric. On 4,844 contracts, TaintSentinel achieves a high F1 of , AUC-ROC of –, and PRA of , significantly outperforming existing tools and enabling production-grade security auditing with scalable inference times.

Abstract

The inherent determinism of blockchain technology poses a significant challenge to generating secure random numbers within smart contracts, leading to exploitable vulnerabilities, particularly in decentralized finance (DeFi) ecosystems and blockchain-based gaming applications. From our observations, the current state-of-the-art detection tools suffer from inadequate precision while dealing with random number vulnerabilities. To address this problem, we propose TaintSentinel, a novel path sensitive vulnerability detection system designed to analyze smart contracts at the execution path level and gradually analyze taint with domain-specific rules. This paper discusses a solution that incorporates a multi-faceted approach, integrating rule-based taint analysis to track data flow, a dual stream neural network to identify complex vulnerability signatures, and evidence-based parameter initialization to minimize false positives. The system's two-phase operation involves semantic graph construction and taint propagation analysis, followed by pattern recognition using PathGNN and global structural analysis via GlobalGCN. Our experiments on 4,844 contracts demonstrate the superior performance of TaintSentinel relative to existing tools, yielding an F1-score of 0.892, an AUC-ROC of 0.94, and a PRA accuracy of 97%.
Paper Structure (35 sections, 6 equations, 6 figures, 7 tables, 2 algorithms)

This paper contains 35 sections, 6 equations, 6 figures, 7 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Smart Contracts and Blockchain Security
  4. Bad randomness vulnerability
  5. Taint Analysis in Smart Contract Security
  6. Related Work
  7. Specialized Bad Randomness Detection Tools
  8. General Tools for Detecting Bad randomness Vulnerabilities
  9. AI/ML-Based Strategies
  10. Literature Reviews and Surveys
  11. Methodology
  12. Phase 1: Role-based Incremental Preprocessing
  13. Phase 2: Dual-Stream Learning Model
  14. Path-Focused Stream
  15. Global Context Stream
  16. ...and 20 more sections

Figures (6)

  • Figure 1: TaintSentinel Framework Overview: Two-phase smart contract randomness vulnerability detection
  • Figure 2: Confusion matrices showing prediction accuracy for (a) balanced and (b) imbalanced datasets
  • Figure 3: Comprehensive performance comparison between balanced and imbalanced scenarios
  • Figure 4: ROC curves showing model's discriminative ability for (a) balanced dataset (AUC = 0.951) and (b) imbalanced dataset (AUC = 0.940)
  • Figure 5: Training dynamics: loss and F1-Score evolution during training for balanced (top) and imbalanced (bottom) datasets
  • ...and 1 more figures