Search papers, labs, and topics across Lattice.
This paper introduces CVE-Smart-Contracts, a curated dataset of vulnerability claims from the CVE database specifically focused on Ethereum smart contracts, which includes both vulnerable artifacts and detailed metadata. The automated methodology for retrieving and validating CVE records allows for efficient labeling and localization of vulnerabilities, with a small portion requiring manual validation. Key findings reveal 491 records linked to deployed contracts, providing a valuable resource for empirical security research and the assessment of code analysis techniques.
A comprehensive dataset of Ethereum smart contract vulnerabilities reveals critical insights into the security landscape of blockchain applications.
The Common Vulnerabilities and Exposures (CVE) database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated dataset of CVE records up to July 2026 referring to Ethereum smart contracts. The dataset contains the vulnerable artifacts (source code and runtime bytecode), labels according to three taxonomies, and function-level locations. The retrieval of CVE records, collection of additional evidence, validation of the correspondence between records and artifacts, label assignment, and vulnerability localization are automated, leaving 15% to manual analysis. The dataset does not validate the original vulnerability claims, but marks a few records obviously wrong as `refuted'. For the sake of reproducibility, all external inputs are retained, so that rerunning the pipelines results in the same outputs. The dataset comprises 491 records linked to deployed contracts, 26 referring to projects (mostly libraries), 45 without validated artifacts, and six records with refuted claims. The dataset supports empirical security research, in particular the evaluation of code analysis and repair techniques.
