Slice-Anchored Multimodal Fusion for Function-Level Smart Contract Vulnerability Detection

Smart contract vulnerability detection has evolved through three broad phases: rule-based static analysis, sequential machine learning, and graph-based deep learning. Each phase addressed a limitation of the previous one, and each introduced new limitations of its own. We organize the literature around this progression and identify the gap our work targets.

Early detection tools used symbolic execution, fuzz testing, and static analysis to apply hand-crafted vulnerability patterns to contract source or bytecode. Symbolic execution approaches such as Oyente and its successors enumerate execution paths against constraint solvers [5], while static-analysis frameworks such as Slither operate on intermediate representations of Solidity source [9], and bytecode-focused analysers such as Mythril combine symbolic execution with taint analysis [8]. Improved bytecode-level CFG construction has continued to refine this line of work [14]. These tools are precise on the patterns they encode but require expert knowledge for every new vulnerability class, suffer from path-explosion on large contracts, and cannot adapt to emerging vulnerability patterns. The first wave of machine-learning approaches addressed this brittleness through learned features over surface representations: S-gram extracted n-gram language models from AST token sequences [15]; ContractWard combined opcode-level feature extraction with classical classifiers and reported strong performance on Ethereum contracts [16] and SoliAudit combined machine learning with grey-box fuzz testing to remove dependence on expert rules [17]. A broader survey of this line is provided in reference [1]. However, all of these methods still treated contracts as flat token or opcode sequences, discarding structural and control flow information that is central to how vulnerabilities actually manifest.

Deep learning enabled automatic feature extraction from raw contract code and removed the manual-feature bottleneck. An optimised CodeBERT variant that extracts vulnerable function segments and leverages CodeBERT's pre-training for classification, achieving high F1 on the SolidiFI benchmark, was proposed [11]. Deng et al. [18] combined CNN and BiGRU networks to extract local and sequential features from contract opcodes and fused these complementary views through a multimodal decision mechanism, and subsequent deep learning frameworks have continued to refine this line of work with novel architectures and multi-objective training objectives [2, 12, 13]. Yet sequential models share a fundamental limitation: they consume contract source or opcodes as a one-dimensional token sequence and cannot directly represent the control flow, data flow, and inter-procedural relationships that determine whether a vulnerability is exploitable. A function with a call.value invocation is vulnerable only when its state update follows the call and no access-control modifier intervenes, a property that depends on graph structure, not on token order.

This limitation motivated graph-based and multimodal approaches that consume CFGs, AST, CGs, and program-dependence graphs (PDGs) through graph neural networks. The progression visible in the table is consistent: from single-graph methods (DR-GCN and TMP on contract graphs [19], CGE extending these with expert patterns [20], MANDO using heterogeneous CFG + CG [21]) to multi-graph fusion (Cai’s sliced AST + CFG + PDG joint graph [22], Ma’s hierarchical AST + CFG attention [23], Shang’s connectivity-enhanced CFG with transformers [24]). Peculiar combined critical data-flow graphs with pre-trained code representations [6], and VulnSense combined a language model with graph neural networks over multiple contract representations [25]. Cai et al. [22] further extended this direction with heterogeneous code-feature learning and automated dataset construction [4]. Across these methods, however, multimodal fusion is performed by independently pooling each modality into a single global vector and then concatenating or attentively weighting those vectors before classification. This pool-then-fuse pattern discards the correspondence between specific source-code statements and the graph nodes that represent them: after pooling, the model can no longer tell which statement contributed which signal. For vulnerability classes whose discriminative pattern is local to a single statement (a missing authorization check, a state update after an external call, a use of TX), this loss of statement-level alignment is precisely where existing multimodal methods leave information on the table.

The gap our work targets is therefore not the absence of multimodality, nor the absence of slicing - both have been explored. It is the absence of statement-level cross-modal alignment in existing multimodal fusion. Our slice-anchored fusion mechanism explicitly aligns CodeBERT [26] token spans to CFG nodes via the slicer’s character-span map, performs cross-modal fusion at the statement level, and only then aggregates - inverting the pool-then-fuse ordering used by every method. The remainder of this paper describes this mechanism, its empirical behavior in a controlled within-family ablation against global concatenation and weighted-fusion baselines, and a comparison against reimplemented prior slicing-based detectors on identical data and splits.

4.png

Figure 4. Slice-anchored fusion for smart contract vulnerability detection

4.1 Structural Vulnerability Program Slicing

Program slicing is the process of extracting from a larger program the subset of statements that influence a chosen point of interest, known as the slicing criterion. In the context of smart-contract security, the criterion is naturally taken to be a statement that has the potential to trigger a vulnerability - a call to an untrusted external address, a use of TX for authorisation, a self-destruct, and so on. A smart-contract function typically contains many statements that have no bearing on such operations: arithmetic helpers, accessor methods, event emissions, and other supporting logic that contribute volume but not security signal. Including these statements indiscriminately during feature extraction injects noise into the learned representation and dilutes the features that actually distinguish vulnerable from safe code. The purpose of program slicing in our pipeline is therefore to retain only those statements that are causally connected to a vulnerability-triggering operation, both through the data that flows into it and through the control conditions that gate its execution. In this study, we use the Structural Vulnerability Program Slicing (SVPS) framework to extract vulnerability-related code fragments from the smart contract, as shown in Algorithm 1.

We refer to our procedure as SVPS and apply it independently to every function in the contract. SVPS operates in three stages. The contract is first compiled and statically analysed using Slither with a pragma-matched solc version, producing the function-level CFG, the AST, and the CG. A set of vulnerability sinks is then identified across the entire contract. These sinks fall into three groups aligned with the vulnerability classes considered in this work: RE-related operations (call, low-level calls, and ether transfers), TX references used in an authorization context, and access-control-sensitive operations (selfdestruct, delegate call, and explicit owner or role checks). The choice of sinks is informed by established taxonomies of smart-contract vulnerabilities and reflects the operations through which the corresponding flaws manifest. Finally, for each function containing at least one such sink, the algorithm performs a backward slice from every sink in that function, traversing both data-dependence relationships-variables whose definitions reach the sink along def-use chains and control-dependence relationships-predicates whose outcome determines whether the sink is reached. The union of statements gathered through these dependence chains, together with the sink statements themselves, constitutes the slice for that function.

Once the slice has been computed, three structural views of the function are produced directly in graph space rather than by recompiling text fragments. The CFG is pruned to the slice nodes, and the edges of removed nodes are bypassed through transitive reconnection so that reachability between the surviving statements is preserved. The AST is reduced to the syntactic subtree spanning the slice statements, retaining the hierarchical relationships needed for syntactic feature learning. The CG is restricted to the function under analysis together with its directly invoked callees, providing the inter-function context that influences vulnerability behavior. In addition to these three graph projections, an alignment map is constructed linking each surviving CFG node to its corresponding token span in the source code; this alignment is the structural anchor consumed by the slice-anchored fusion mechanism introduced later in the paper. Functions in which no sink is present are labelled non-vulnerable and bypass the slicing step.

4.2 Semantic representation using CodeBERT

Vulnerability-relevant code fragments are extracted by using the SVPS algorithm. Then, relevant code fragments are passed to CodeBERT, a pre-trained transformer-based model specifically adapted for programming languages [26]. CodeBERT has found wide application in capturing contextual semantics of source code, due to its bidirectional attention models trained on large-scale code corpora.

The code fragment is first broken down into a series of tokens which is denoted by the Eq. (1), where t_i denotes the ith token in the fragment and n represents the total number of tokens in the sequence. Each token is then encoded into a continuous embedding using the CodeBERT embedding layer as shown in Eqs. (2) and (3).

$T=\left\{t_1, t_2, \ldots, t_n\right\}$            (1)

$e_i=E\left(t_i\right), e_i \in R^d$         (2)

$E_T=\left\{e_1, e_2, \ldots, e_n\right\}$     (3)

These embeddings are processed by a multi-layered transformer encoder that learns contextual relationships between tokens via a self-attention mechanism, which is mentioned in Eqs. (4)–(6). The transformer encoder generates contextual representations of every token in the sequence. Lastly, a pooling operation combines token representations into a fixed-length semantic embedding that represents the entire code fragment. This semantic representation is contextual information based on vulnerability-relevant code fragments and serves as the semantic feature representation used at later stages of the identified framework.

$h_i^{(l)}=$ Encoder $_{\text {CodeBERT}}\left(h_i^{(l-1)}\right), h_i^{(0)}=e_i$       (4)

$Q=H W_Q, K=H W_K, V=H W_V$            (5)

$\operatorname{Attention}(Q, K, V)=\operatorname{softmax}\left(\frac{Q K^T}{\sqrt{d_k}}\right) V$            (6)

$H=h_1, h_2, h_3, \ldots \ldots, h_n$           (7)

$h_{\text {sem}}=1 / n \sum_{i=1}^n h_i$          (8)

4.3 Structural representation of smart contracts

The structural representation of smart contracts refers to transforming raw source code into structured formats that capture both syntactic and semantic information. Instead of treating the contract as plain text, it is represented using program structures such as ASTs, CFGs, and CGs [14, 27]. The AST captures the hierarchical syntactic structure of the code, while the CFG represents the flow of execution between different statements. The CG models the interactions between functions, highlighting internal and external function calls, which are crucial for detecting vulnerabilities such as RE and AC issues. This multi-level structural representation enables a comprehensive understanding of a smart contract.

4.3.1 Abstract Syntax Tree

AST is a hierarchical syntactic structure of a smart contract. Each node in AST corresponds to a language construct such as expressions, statements, or declarations. It can be formally defined as:

$T=(V, E)$         (9)

$x_i \in R^d$          (10)

where, V is the set of nodes and E ⊆ V × V denotes the parent-child relationships. Each node $v_i \in V$ is associated with a feature vector, which captures syntactic or semantic attributes. This representation enables structured analysis of program syntax.

4.3.2 Control Flow Graph

The CFG models the execution flow of a smart contract by representing all possible execution paths. It is defined as:

$G_{c f g}=\left(N, E_{c f g}\right)$        (11)

where, N is the set of basic blocks and $E_{c f g} \subseteq N \times N$ represents control flow transitions. For any edge $\left(n_i, n_j\right) \in E_{c f g}$, control may transfer from n_i to n_j. This structure helps in analyzing execution behavior and identifying logical vulnerabilities.

4.3.3 Call Graph

The CG captures the function invocation relationships within a smart contract. It is defined as:

$G_{c g}=\left(F, E_{c g}\right)$       (12)

where, F is the set of functions and $E_{c g} \subseteq F \times F$ represents calling relationships. An edge $\left(f_i, f_j\right) \in E_{c g}$ indicates that function f_i invokes function f_j. The graph can be represented using an adjacency matrix and feature matrix are given below:

$A \in R^{|F| \times|F|}$          (13)

$X \in R^{|F| \times d}$          (14)

4.4 Graph Convolutional Networks

Unlike conventional deep models that operate on Euclidean data such as images or sequences, the GCN is designed for non-Euclidean structures in which relationships between entities are expressed as edges in a graph. By aggregating information along these edges, the GCN captures both the local neighborhood of each node and, through stacked layers, the wider structural context [28].

In this study we apply three independent GCN encoders, one for each of the structural views produced by the slicing stage: the CFG, the AST, and the CG (CG). Each graph $G^{(k)}$ for $k \in\{C F G, A S T, C G\}$ is described by its adjacency matrix $A^{(k)} \in R^{n_k \times n_k}$ and a node-feature matrix $X^{(k)} \in R^{n_k \times d_k}$, where $n_k$ is the number of nodes in the pruned graph. For the CFG and AST encoders, the initial node features are learned embeddings of the syntactic node type (statement category, expression type, control construct, and so on). For the CG encoder, the features are a small set of structural descriptors of each function node-namely a root-status indicator together with the in-degree and out-degree.

Here $H^{(k, 0)}=X^{(k)}$ is the initial node-feature matrix, $W^{(l)}$ is the trainable weight matrix at layer 1 , and $\sigma($.$) is a non-linear$ activation (ReLU). Eq. (16) gives the symmetric normalization of the adjacency matrix with added self-loops: $A^{(k)}+I$ ensures that each node includes its own features alongside those of its neighbours during aggregation, and $\widetilde{D}$ is the diagonal degree matrix of $A^{(k)}+I$. After $L$ layers, the resulting node representations $H^{(k)} \in R^{n_k \times d^{\prime}}$ form the output of the GCN encoder for graph $k$. Each encoder propagates information through $L$ layers using the GCN update rule:

$H^{(k, l+1)}=\sigma\left((\tilde{A})^{(k)} H^{(k, l)} W^{(l)}\right)$        (15)

$(\tilde{A})^{(k)}=(\widetilde{D})^{-\frac{1}{2}}\left(A^{(k)}+I\right)(\widetilde{D})^{-\frac{1}{2}}$        (16)

$H^{(k)}=H^{(k, l)} \in R^{n_k \times d^{\prime}}$       (17)

The way these per-node embeddings are subsequently consumed depends on the fusion strategy. In the baseline fusion variants (concatenation and weighted fusion), each graph’s node embeddings are reduced to a single graph-level vector by mean pooling, and the three resulting vectors are concatenated with the semantic representation before classification. In the proposed slice-anchored fusion variant, the CFG node embeddings H^(CFG) are retained at the node level and combined with the corresponding CodeBERT token-span representations at the statement level, as detailed in Section 4.6; the AST and CG embeddings continue to be globally pooled in this variant.

4.4.1 Graph-level pooling

For the baseline fusion variants, and for the AST and CG branches inside the proposed slice-anchored variant of Section 4.6, a fixed-size representation of each graph is obtained by mean-pooling the GCN node embeddings:

$h^{(k)}=\frac{1}{n_k} \sum_{i=1}^{n_k} h_i^{(k)}$       (18)

where, n_k denotes the number of nodes in the pruned graph G^(k). The proposed slice-anchored variant deliberately retains the CFG node embeddings H^(CFG) at the node level rather than pooling them, so that each surviving statement can be aligned to its corresponding graph position during fusion.

4.4.2 Multi-graph baseline fusion

In the baseline fusion variants, the three pooled graph vectors are concatenated into a single structural representation that summarizes syntactic structure, control flow, and inter-function interactions:

$h_{\text {graph}}=h^{(\mathrm{AST})}\left\|h^{(\mathrm{CFG})}\right\| h^{(\mathrm{CG})}$       (19)

where, denotes concatenation. The full concatenation ablation pairs h_graph with the CodeBERT semantic vector h_sem before classification, while the weighted-fusion ablation of Section 4.5 combines them through learned attention weights.

4.5 Weighted fusion

The CodeBERT semantic representation captures contextual information drawn from the source code, while the graph-based representation built from the AST, CFG and CG captures structural dependencies. A natural way of combining the two modalities, used as one of the baselines in our experiments, is a weighted hybrid fusion mechanism:

$\tilde{h}_{\text {graph}}=W_g h_{\text {graph}}, \tilde{h}_{\text {sem}}=W_s h_{\text {sem}}$       (20)

$h_{\text {fusion}}=\alpha \cdot \tilde{h}_{\text {graph}}+(1-\alpha) \cdot \tilde{h}_{\text {sem}}$      (21)

$\alpha=\frac{\exp \left(w^T \tilde{h}_{\text {graph}}\right)}{\exp \left(w^T \tilde{h}_{\text {graph}}\right)+\exp \left(w^T \tilde{h}_{\text {sem}}\right)}$           (22)

$z=W_f h_{f u s i o n}+b_f, \hat{y}=\operatorname{Softmax}(z)$     (23)

Instead of treating the two modalities equally, the model assigns adaptive importance to each, allowing it to balance structural and contextual cues according to the input. The weight α is computed dynamically per sample, the fused vector is passed through a fully connected layer, and a Softmax produces the predicted vulnerability class. As reported in Section 5, this strategy is outperformed in our experiments by the slice-anchored fusion mechanism introduced next.

4.6 Slice-anchored fusion

Both fusion strategies described above reduce each modality to a single globally-pooled vector before combination, which discards the alignment between individual source statements and the corresponding nodes of the CFG. The proposed slice-anchored fusion mechanism preserves this alignment by performing cross-modal combination at the statement level rather than at the graph level.

Let $S=\left\{s_1, s_2, \ldots, s_M\right\}$ denote the ordered set of statements retained by the slicing stage for a given function. From the alignment map $A_f$ produced by Algorithm 1, each statement $s_i$ is associated with (i) a token-index span $\left(s_i\right)=\left\{j_a, \ldots, j_b\right\}$ in the CodeBERT input and (ii) a CFG node index $v\left(s_i\right)$. The per-statement semantic representation is obtained by mean-pooling the CodeBERT token embeddings over the span:

$t_i=\frac{1}{\left|\operatorname{span}\left(s_i\right)\right|} \sum_{j \in \operatorname{span}\left(s_i\right)} e_j$          (24)

where, $e_j \in R^{d_{\text {bert}}}$ is the CodeBERT embedding of token j. The corresponding per-statement structural representation is read directly from the CFG encoder output at the aligned node:

$n_i=H_{v\left(s_i\right)}^{(C F G)}$         (25)

The semantic vector is then projected to the GCN hidden dimensionality and fused with the structural vector through a small multi-layer perceptron ϕ:

$h_i=\phi\left(W_t t_i \| n_i\right)$       (26)

Eq. (26) binds the semantic content of statement $s_i$ to its position in the CFG; this per-statement cross-modal binding is the central operation of the proposed mechanism. The fused statement vectors are aggregated into a single slice-level representation by mean-pooling:

$z_{\text {stmt}}=\frac{1}{M} \sum_{i=1}^M h_i$           (27)

The AST and CG views, which are not statement-aligned, continue to be summarised globally via Eq. (18). The three resulting representations are combined through learned softmax-normalised weights:

$z=\alpha_{\text {stmt}} z_{\text {stmt}}+\alpha_{\text {ast}} h^{(A S T)}+\alpha_{\text {cg}} h^{(C G)}$       (28)

$\hat{y}=\operatorname{Softmax}\left(W_f z+b_f\right)$     (29)

By performing cross-modal fusion before any global pooling step on the CFG side, the model is able to represent ordered, control-dependent patterns such as the call-before-update structure characteristic of RE-a pattern that global fusion strategies necessarily blur.

In order to test the efficacy of the proposed approach, we compared it with conventional smart contract vulnerability detection tools, namely Slither and Mythril. These tools use rule-based and static analysis techniques. These two tools are designed to detect specific types of vulnerabilities. The comparative analysis has been performed in three categories of vulnerabilities, namely RE, AC, and TX, using the evaluation measures, which include the Accuracy, Precision, Recall, and F1-score and the results of the experiment are presented in Figure 5 and Figure 6.

5.png

Figure 5. Performance comparison of the proposed method against baseline tools

6.png

Figure 6. Effect of learning rate and batch size on model performance

Among the compared methods, the proposed method achieves significantly higher values across all evaluation metrics, indicating its strong capability in identifying RE vulnerabilities. The improvement is particularly notable in terms of precision and F1-score, reflecting more accurate and balanced detection. Within the AC vulnerabilities, traditional methodologies typically exhibit moderate efficiency, with significant variation across performance indicators. On the other hand, when it comes to vulnerabilities related to TX, the effectiveness of the implemented tools is significantly reduced and unstable. In turn, these empirical findings support the idea that the given approach yields significantly better outcomes in detecting vulnerabilities in smart contracts.

To further decompose the role of each component within the proposed framework, a sequence of experiments is performed. The first stage of the model is tested using only CodeBERT’s semantic features, without any structural information. The findings suggest that although CodeBERT is an effective extractor of contextual and semantic patterns, it is nevertheless unable to capture the structural relationships inherent in smart contracts, resulting in mediocre performance across all measures. Additional experiments have been conducted using DL models such as LSTM, BiLSTM, and BERT; the results are listed in Table 2. This analysis aims to assess the consistency of CodeBERT’s performance gains relative to other sequence and transformer-based architectures. The LSTM and BiLSTM have relatively lower performance, indicating limited ability to learn complex contextual dependencies in smart contract code. Transformer-based models, on the contrary, are more effective. BERT demonstrates significant progress over other recurrent models by achieving an accuracy of 87.45%, and embedding contextualization is a crucial factor. CodeBERT also improves performance across all evaluation metrics, achieving 89.46% accuracy, 87.35% sensitivity demonstrating the benefit of domain-specific pre-training for source code comprehension. These findings confirm the idea that the use of CodeBERT is not a random decision but a rational one, as it continues to show better performance than the other baseline models. Further experiments are carried out separately using graph-based representations: AST, CFG, and CG. A graph will capture certain elements of the contract behaviour when considered individually. The AST-based model is effective at learning syntactic patterns, the CFG-based model is successful at recording the dependencies of the execution flow, and the CG is effective at examining inter-function interactions. However, in isolation, these representations offer only limited performance, insufficient to provide the full structural and semantic information needed for accurate vulnerability detection. The additional experiments are then conducted by integrating the graph representation (AST + CFG + CG), leading to performance improvements that are clearly superior to those of isolated graph-based models, the detailed results are shown in Table 3. This shows that when a multitude of structural views is incorporated, the model will be better able to comprehend a system’s program behaviour.

To assess the concatenation/weighted comparison strategies are evaluated and presented in Table 4. The concatenation-based fusion method achieved an accuracy of 89.46% and an F1-score of 87.76%, and is close to the standalone CodeBERT model. It means that the feature concatenation is limited in its ability to fully exploit the complementary information available in the semantic and structural representations. The proposed slice anchored approach is, conversely, much more efficient across all evaluation metrics, achieving an accuracy of 90.48%, precision of 89.32%, recall of 89.74%, and F1-score of 89.62%. The weighted feature fusion achieved an improvement over the concatenation method.

Table 2. Performance comparison of semantic feature encoders

Table 3. Performance comparison of graph-based features

Table 4. Concatenation vs. weighted fusion vs. slice-anchored

The proposed Slice-Anchored Fusion outperforms both baselines across every evaluation metric. It achieves an accuracy of 91.35%, a precision of 90.87%, a recall of 92.12%, and an F1-score of 91.49%. These findings indicate that the Slice-Anchored Fusion can dynamically balance the roles of semantic and structural features and provide a complete set of features. Figures 7–9 presents the confusion matrices for the codeBERT based model, graph-based model and the proposed approach, highlighting the improved class-wise prediction capability of the proposed method, and Figure 10 shows the training accuracy and validation accuracy curves for the proposed approach.

7.png

Figure 7. Confusion matrix for semantic features

8.png

Figure 8. Confusion matrix for structural features

9.png

Figure 9. Confusion matrix for the proposed feature fusion model

10.png

Figure 10. Training and validation accuracy and loss curves

The next experiment is conducted to analyses the importance of the proposed SVPS code slicing technique. Table 5 presents the experimental results with and without the code-slicing technique. The code-slicing model achieves 87.24% accuracy and 85.68% F1-score, indicating the presence of irrelevant and redundant information. With the addition of code slicing, accuracy improves to 91.35 and 91.49, respectively. This amounts to a 4.1% increase in accuracy and a 5.8% increase in F1-score, confirming the efficacy of targeting vulnerability-relevant code segments.

Table 5. Effect of code slicing on vulnerability detection

Table 6. Comparison against existing baseline methods

Table 6 presents baseline comparison across every vulnerability category. AC remains the hardest class throughout, with F1-scores rising from 0.44 (Slice-LSTM) to 0.53 (proposed). Non-vulnerable contracts are detected reliably by all methods, with F1-scores above 0.97. Macro-F1 improves steadily from 0.795 to 0.840, a 1.5-point gain over Cai et al. [22], the strongest baseline. The proposed method also matches the lowest run-to-run variability (σ = 0.005), showing the improvement is stable, not incidental.