# DAppSCAN: Building Large-Scale Datasets for Smart Contract Weaknesses in DApp Projects

**Authors:** Zibin Zheng, Jianzhong Su, Jiachi Chen, David Lo, Zhijie Zhong, Mingxi Ye  
**arXiv:** [2305.08456](https://arxiv.org/abs/2305.08456)  
**Date:** 2023-05-15  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2305.08456v1/

## Key points

- DAppSCAN is a research project that evaluates tools designed to detect smart contract weaknesses specific to the Ethereum platform.
- The absence of a large, unbiased, real-world dataset has made it difficult to evaluate these tools.
- 22 participants spent 44 person-months analyzing 1,322 open-source audit reports from 30 security teams and identified 10,016 weaknesses.
- Two distinct datasets were developed: DAppSCAN-Source and DAppSCAN-Bytecode.
- The DAppSCAN-Source dataset comprises 25,077 Solidity files sourced from 1,139 real-world DApp projects and features 1,689 SWC vulnerabilities.
- A tool was developed to automatically identify dependency relationships within DApps and complete missing public libraries resulting in the second dataset (DAPPSCAN-Bytecode), which consists of 8,167 compiled smart contract bytecode with 895 SWC weaknesses.
- An empirical study was conducted based on the second dataset (DAPPSCAN-Bytecode) to assess the performance of five state-of-the-art smart contract vulnerability detection tools.
- The results revealed subpar performance for these tools in terms of both effectiveness and success detection rate.
- Future development should prioritize real-world datasets over simplistic toy contracts.
- Overall, DAppSCAN provides a valuable contribution to the field by creating large-scale datasets for smart contract weaknesses in real-world DApp projects.

## Summary

DAppSCAN is a research project that aims to address the challenge of evaluating tools designed to detect smart contract weaknesses specific to the Ethereum platform. The Smart Contract Weakness Classification Registry (SWC Registry) is a widely recognized list of such weaknesses, but the absence of a large, unbiased, real-world dataset has made it difficult to evaluate these tools. To overcome this issue, 22 participants spent 44 person-months analyzing 1,322 open-source audit reports from 30 security teams. They identified 10,016 weaknesses and developed two distinct datasets: DAppSCAN-Source and DAppSCAN-Bytecode. The DAppSCAN-Source dataset comprises 25,077 Solidity files sourced from 1,139 real-world DApp projects and features 1,689 SWC vulnerabilities. To enable the dataset to be compilable for use in evaluation studies, the researchers developed a tool capable of automatically identifying dependency relationships within DApps and completing missing public libraries. This resulted in their second dataset (DAPPSCAN-Bytecode), which consists of 8,167 compiled smart contract bytecode with 895 SWC weaknesses. An empirical study was conducted based on the second dataset (DAPPSCAN-Bytecode) to assess the performance of five state-of-the-art smart contract vulnerability detection tools. The results revealed subpar performance for these tools in terms of both effectiveness and success detection rate. This indicates that future development should prioritize real-world datasets over simplistic toy contracts. Overall, DAppSCAN provides a valuable contribution to the field by creating large-scale datasets for smart contract weaknesses in real-world DApp projects. These datasets can be used by researchers and practitioners alike to evaluate existing detection tools and develop new ones that are more effective at detecting SWC vulnerabilities in Ethereum-based smart contracts.