Pith. sign in

REVIEW 5 major objections 7 minor 86 references

PhishingHook: Catching Phishing Ethereum Smart Contracts leveraging EVM Opcodes

T0 review · 5 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PhishingHook shows that machine-learning classifiers fed only EVM opcode histograms can identify phishing Ethereum smart contracts with about 93 percent accuracy, without replaying transactions.

desk verdict A useful open benchmark for opcode-based phishing detection, with a solid evaluation that is somewhat overstated in the abstract; the core result is plausible but label and tuning caveats need addressing. read the letter →

arxiv 2506.19480 v1 pith:7ZOHH6G5 submitted 2025-06-24 cs.CR

Pasquale De Rosa , Simon Queyrut , Yérom-David Bromberg , Pascal Felber , Valerio Schiavoni This is my paper
classification cs.CR
keywords EthereumsmartcontractsphishingdetectionEVMopcodesbytecodeanalysismachinelearningRandomForestdataset
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that phishing smart contracts on Ethereum can be detected from their deployed bytecode alone, before any transaction is executed or replayed. It trains and compares 16 machine-learning models across four families on 7,000 real-world bytecodes, of which 3,458 are unique phishing contracts flagged by Etherscan and the rest are treated as benign. The strongest family is the histogram similarity classifier, which counts how often each EVM opcode appears and feeds that vector to classical classifiers; Random Forest reaches 93.63% accuracy. If the result holds, static opcode analysis is a viable privacy-preserving screening tool that avoids the sensitive-data exposure of transaction-trace analysis. The paper also releases the dataset, code, and reproducibility instructions.

What carries the argument

The load-bearing object is the opcode histogram: a vector, as long as the number of unique EVM opcodes, recording how many times each opcode appears in the disassembled bytecode. This vector is fed directly into classical classifiers without normalization, and the paper shows that a Random Forest built on these counts outperforms all 15 other models. The supporting machinery includes a bytecode extraction module that pulls deployed code through Etherscan's eth_getCode endpoint, a disassembler updated for Shanghai-fork opcodes, 10-fold cross-validation repeated three times, and a post hoc statistical layer (Shapiro-Wilk, Kruskal-Wallis, and Dunn's tests) that establishes that cross-category performance differences are significant.

What would settle it

Audit a random sample of contracts labeled benign in the released dataset by manually inspecting their bytecode for known phishing patterns, move confirmed phishing cases into the positive class, and retrain; if accuracy drops substantially, the 93% figure was an artifact of label noise.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that the relative frequency of EVM opcodes in a contract's bytecode is sufficient for accurate phishing classification on a one-year sample of Ethereum deployments. Random Forest on raw opcode histograms reaches 93.63% accuracy with 94.23% precision and 92.76% recall, and the average of all seven histogram classifiers is 91.52% accuracy, higher than the language models (88.83%), vision models (83.75%), and the vulnerability detector (55.91%). The paper interprets the gap as evidence that phishing contracts leave statistical traces in code structure rather than only in transaction behavior, and that large language models scale better with more data even though they do not beat histograms at this dataset size.

Load-bearing premise

The entire comparison rests on treating Etherscan's Phish/Hack flag as correct and complete, so any phishing contract that Etherscan missed is silently counted as benign and inflates the reported accuracies.

Editorial extensions

If this is right

  • Phishing contracts can be screened statically before deployment or user interaction, sidestepping the privacy and security risks of replaying transactions tied to malicious actors.
  • Simple, cheap classifiers match or beat large pretrained models on this task: Random Forest trains in seconds and stays accurate across nine monthly test windows (AUT = 0.89).
  • Language and vision models scale better with data, so enlarging the phishing dataset should raise their accuracy even when histograms plateau.
  • The released 7,000-bytecode dataset, with 3,458 unique phishing bytecodes, gives other researchers a common benchmark for opcode-based phishing detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Since the benign class is defined as 'not flagged by Etherscan,' unflagged phishing contracts would sit in the benign set and make every reported accuracy optimistic; the released dataset lets anyone quantify this by manual audit.
  • If the histogram signal generalizes, the same recipe should transfer to other EVM-compatible chains and to newer forks, since it requires only deployed bytecode, not source code or transaction history.
  • The scalability result suggests a practical deployment path: run a cheap histogram classifier at wallet signing time and reserve expensive language models for a slower, deeper review layer.
  • The time-resistance experiment covers nine months; a longer study spanning hard-fork changes and new phishing templates would test whether the opcode patterns drift.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper presents PhishingHook, a framework for binary classification of Ethereum smart contracts as phishing or benign using only deployed bytecode and its opcode-level features. The authors collect contracts deployed between October 2023 and October 2024, label them with Etherscan's 'Phish/Hack' flag, and build a dataset of 7,000 bytecodes containing 3,458 unique phishing bytecodes and a similar number of benign samples. They evaluate 16 models in four categories (histogram similarity classifiers, vision models, language models, and a vulnerability detection model) using 10-fold cross-validation repeated three times. The best reported result is Random Forest at 93.63% accuracy, and the framework, dataset, and enhanced disassembler are publicly released.

Significance. If the central accuracy claims hold, PhishingHook is a useful open benchmark and an unusually broad comparison of opcode-level phishing detectors. The paper's explicit strengths are the public release of the phishing dataset, the open-source framework and reproducibility scripts, the inclusion of the time-resistance protocol inspired by TESSERACT, the post hoc statistical testing, and the SHAP-based interpretability analysis. The results suggest that simple opcode histograms can separate a convenience sample of Etherscan-flagged phishing contracts from unflagged contracts with roughly 93% accuracy, which is an interesting and practically relevant finding for pre-deployment screening. However, this significance is conditional on the validity of the Etherscan labels and on the soundness of the evaluation protocol.

major comments (5)
  1. [III (Data gathering/Dataset construction)] The binary ground truth is Etherscan's 'Phish/Hack' flag, and benign samples are defined as contracts 'not flagged' as malicious. No independent validation of these labels is provided, and the statement that Etherscan 'acts as an independent source of smart contract validation and security analysis' is not backed by the cited reference [37], which concerns community abuse reports rather than Etherscan's own flagging process. Unflagged phishing contracts that enter the benign class change the measured metrics in a direction that is not monotone but is material in both cases, and the flagged positives are a convenience sample that may be biased toward simple or already-reported scams. Please add a random-sample manual audit, a cross-check against at least one other labeling source, and an explicit discussion of how selection in Etherscan's flagging affects generalization.
  2. [IV-C] Hyperparameter selection is described as a 'grid search over an arbitrary search space on the same task as the main evaluation, using 10-fold cross-validation,' but the paper does not state whether this search is nested inside the outer evaluation folds or whether a separate validation set is used. If the same folds served both for hyperparameter tuning and for the reported accuracy numbers, the Random Forest figure of 93.63% is optimistically biased and the variance is underestimated. Please specify the exact protocol and, if needed, re-run the evaluation with nested cross-validation or a fixed validation split.
  3. [III (Dataset construction)] The phishing set is deduplicated (17,455 obtained bytecodes reduced to 3,458 unique bytecodes), but the paper does not state whether the benign samples are deduplicated. Given the documented high rate of identical minimal-proxy bytecodes on the phishing side, duplicate benign bytecodes may also be common, and a random 10-fold split could place identical bytecodes in both training and test folds. Please report unique-bytecode counts for both classes and split the data at the unique-bytecode level, or otherwise demonstrate that benign duplication is negligible.
  4. [IV-D and Table II] Table II reports metrics averaged over 10 folds and 3 runs without any standard deviations, confidence intervals, or per-fold results. The differences among Random Forest (93.63%), XGBoost (93.43%), and LightGBM (93.39%) are small, and without dispersion measures the reader cannot assess whether the 'best model' claim is stable across folds and runs. Please report variance measures or the underlying per-run/per-fold distributions.
  5. [Abstract and IV-D] The aggregate accuracy statement is internally inconsistent. The abstract says 'about 90% average accuracy among all the models,' and Section IV-D says 'All models achieve reasonable performance ... with an average Accuracy of 89.07%.' However, the arithmetic mean of the Accuracy column in Table II over all 16 models is 87.0%, while 89.07% is the average over only the 15 models after excluding ESCORT. Additionally, Section IV-E excludes ESCORT, GPT-2β, and T5β as 'worst-performing' before the statistical comparison, a post hoc selection that can inflate the significance of observed differences. Please report aggregate statistics over a predefined model set and justify any exclusions before the results are known.
minor comments (7)
  1. [Abstract] The abstract says '7,000 real-world malware smart contracts,' but the dataset contains both phishing and benign (non-flagged) contracts; please rephrase to reflect the actual composition, e.g., '7,000 real-world bytecodes, including phishing and benign contracts.'
  2. [IV-C] The text says 'grid search' but Optuna is a metaheuristic optimization framework; please use 'hyperparameter search' or explain how a grid was combined with Optuna.
  3. [Fig. 2] The y-axis label '#contracts 15' is unclear and appears to be a typo or formatting artifact; please state the units and explain why the 'Obtained phishing contracts' line is higher than the 'Unique phishing contracts' line.
  4. [Fig. 4] The legend mentions significance levels from 'highly significant' down to 'mildly significant,' but the symbols are not explicitly defined and the 'ns' labels are too small to be readable; please add an explicit legend and increase font size.
  5. [IV-F] The sentence 'The impact of data augmentation on complex models' appears to refer to the effect of increasing the data split ratio, not to data augmentation; please correct this wording.
  6. [IV-D] The statement 'Our results align with the original papers' is misleading for ECA+EfficientNet, which reported 98.2% accuracy while this paper reports 86.63%; please revise to a more precise comparison that highlights the different datasets and task definitions.
  7. [IV-E] The phrase 'the number of observation for each metric' should be 'the number of observations for each metric.'

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported accuracies are measured on held-out cross-validation folds against externally sourced Etherscan labels, not derived from the models' own fitted assumptions.

full rationale

The paper's central claim is an empirical benchmark, not a derivation. PhishingHook labels contracts using Etherscan's external "Phish/Hack" flag and defines benign samples as those not flagged, then evaluates 16 models with 10-fold cross-validation over 3 runs on a 7,000-bytecode dataset. The headline accuracy figures (e.g., Random Forest 93.63% in Table II) are therefore held-out measurements with respect to an external ground-truth source, so they are not fitted into existence by the paper's own equations. There is no load-bearing self-citation: the authors' own dataset release [70] is an artifact, not a premise. The remaining concerns, such as Optuna hyperparameter selection on the same task and excluding underperforming models from the post hoc analysis, are methodological limitations that could bias or weaken the statistical claims, but they do not make any reported prediction definitionally equivalent to the model's inputs. The reliability of Etherscan as ground truth is a correctness risk (unflagged phishing in the benign set would change the absolute numbers), not a circularity, because the labels come from an independent external service and the evaluation does not assume the conclusion. Hence no circular step meets the quoted-evidence bar.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claims rest on label quality, deduplication choices, and standard supervised learning assumptions. No new entities are introduced. The only fitted quantities are the model hyperparameters, whose final values are not reported.

free parameters (3)
  • Model hyperparameters = not reported
    Optuna grid search over an arbitrary search space tuned hyperparameters for all 16 models on the same task as the main evaluation (Section IV-C); final hyperparameter values are not listed.
  • Dataset sampling window = October 2023 to October 2024
    Contract collection restricted to a 12-month window; results may not generalize outside this period (Section III, Data gathering).
  • Benign sample size = approximately 3,542 (to total 7,000)
    Benign contracts sampled to roughly match the 3,458 unique phishing contracts; balance choice affects metrics (Section III, Dataset construction).
assumptions (5)
  • domain assumption Etherscan's Phish/Hack flag is an accurate and complete ground-truth label for phishing contracts.
    The entire dataset labels come from etherscan.io; the paper calls it an independent source of smart contract validation and security analysis (Section III, Data gathering).
  • domain assumption Unflagged contracts are benign.
    Benign samples are defined as contracts not flagged as malicious on etherscan.io (Section III, Dataset construction); undetected phishing in this set would bias accuracy.
  • domain assumption Duplicate bytecodes correspond to the same contract and can be deduplicated without loss for benign samples too.
    Deduplication is applied to phishing bytecodes due to minimal proxy clones, but the paper does not state that benign bytecodes were deduplicated (Section III, Dataset construction).
  • standard math Standard supervised-learning assumptions (i.i.d. samples, representative cross-validation) hold for the bytecode dataset.
    10-fold cross-validation and post hoc statistics rely on independence of samples (Sections IV-D and IV-E).
  • domain assumption Opcode-level features capture the signal distinguishing phishing from benign contracts.
    The whole framework analyzes only bytecode and opcodes, not transaction traces or source code (Section III); the paper itself shows per-opcode frequency distributions are similar (Fig. 3).

how reviews work

0 comments
Cite this review

Pith. "Pith review of PhishingHook: Catching Phishing Ethereum Smart Contracts leveraging EVM Opcodes." pith.science (2026). https://pith.science/paper/7ZOHH6G5

@misc{pith2026250619480,
  author       = {Pith},
  title        = {Pith review of: PhishingHook: Catching Phishing Ethereum Smart Contracts leveraging EVM Opcodes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7ZOHH6G5}},
  note         = {Machine review of arXiv:2506.19480}
}
read the original abstract

The Ethereum Virtual Machine (EVM) is a decentralized computing engine. It enables the Ethereum blockchain to execute smart contracts and decentralized applications (dApps). The increasing adoption of Ethereum sparked the rise of phishing activities. Phishing attacks often target users through deceptive means, e.g., fake websites, wallet scams, or malicious smart contracts, aiming to steal sensitive information or funds. A timely detection of phishing activities in the EVM is therefore crucial to preserve the user trust and network integrity. Some state-of-the art approaches to phishing detection in smart contracts rely on the online analysis of transactions and their traces. However, replaying transactions often exposes sensitive user data and interactions, with several security concerns. In this work, we present PhishingHook, a framework that applies machine learning techniques to detect phishing activities in smart contracts by directly analyzing the contract's bytecode and its constituent opcodes. We evaluate the efficacy of such techniques in identifying malicious patterns, suspicious function calls, or anomalous behaviors within the contract's code itself before it is deployed or interacted with. We experimentally compare 16 techniques, belonging to four main categories (Histogram Similarity Classifiers, Vision Models, Language Models and Vulnerability Detection Models), using 7,000 real-world malware smart contracts. Our results demonstrate the efficiency of PhishingHook in performing phishing classification systems, with about 90% average accuracy among all the models. We support experimental reproducibility, and we release our code and datasets to the research community.

Figures

Figures reproduced from arXiv: 2506.19480 by the authors.

Figure 1
Figure 1. The PHISHINGHOOK framework. personation of trusted platforms (e.g., dApps [78]). Attack￾ers bait victims with fake incentives (airdrops, staking) via social media or emails, directing them to fraudulent sites mimicking legitimate dApps. After wallet connection, victims are prompted to approve a transaction (e.g., "claim reward"), which secretly authorizes attackers to drain their funds. III. THE PHISHINGHOOK FRAMEWO… view at source ↗
Figure 2
Figure 2. Number of phishing contracts per month over the 2023- [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. Dunn’s test for pairwise comparison between each model’s metrics. Significant if [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Performance metrics of the best models per data split. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 8
Figure 8. Figure 8: Time evolution of performance metrics over nine [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: HSC classifier’s SHAP values of all samples of a test [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

86 extracted references · 72 canonical work pages

  1. [37]

    Sorting out the bad seeds: Automatic classification of cryptocurrency abuse reports.arXiv preprint arXiv:2410.21041, 2024

    Gibran Gomez, Kevin van Liebergen, Davide Sanvito, Giuseppe Siracu- sano, Roberto Gonzalez, and Juan Caballero. Sorting out the bad seeds: Automatic classification of cryptocurrency abuse reports.arXiv preprint arXiv:2410.21041, 2024

    work page arXiv

  2. [1]

    etherscan.io/address/0x279e2f385cE22F88650632D04260382bFB918082

    Smart contract 0x279e2f385ce22f88650632d04260382bfb918082. etherscan.io/address/0x279e2f385cE22F88650632D04260382bFB918082. Accessed: 2025-02-25

    2025

  3. [2]

    ether- scan.io/address/0xb5e7b87e7a84276b13da3f07495e18f3e229d3a0

    Smart contract 0xb5e7b87e7a84276b13da3f07495e18f3e229d3a0. ether- scan.io/address/0xb5e7b87e7a84276b13da3f07495e18f3e229d3a0. Ac- cessed: 2025-02-25

    2025

  4. [3]

    Adjusting for multiple testing when reporting research results: the bonferroni vs holm methods.Am J Public Health, 86(5):726–728, May 1996

    M Aickin and H Gensler. Adjusting for multiple testing when reporting research results: the bonferroni vs holm methods.Am J Public Health, 86(5):726–728, May 1996

    1996

  5. [4]

    Optuna: A next-generation hyperparameter optimiza- tion framework.CoRR, abs/1907.10902, 2019

    Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. Optuna: A next-generation hyperparameter optimiza- tion framework.CoRR, abs/1907.10902, 2019

    arXiv 1907

  6. [5]

    Verification of smart contracts: A survey.Pervasive and Mobile Computing, 67:101227, 2020

    Mouhamad Almakhour, Layth Sliman, Abed Ellatif Samhat, and Abdel- hamid Mellouk. Verification of smart contracts: A survey.Pervasive and Mobile Computing, 67:101227, 2020

    2020

  7. [6]

    A survey of attacks on ethereum smart contracts (sok)

    Nicola Atzei, Massimo Bartoletti, and Tiziana Cimoli. A survey of attacks on ethereum smart contracts (sok). InPrinciples of Security and Trust: 6th International Conference, POST 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings 6, pages 164–186. Springer, 2017

    2017

  8. [7]

    A survey of blockchain applications in the energy sector.IEEE Systems Journal, 15(3):3370–3381, 2020

    Jiabin Bao, Debiao He, Min Luo, and Kim-Kwang Raymond Choo. A survey of blockchain applications in the energy sector.IEEE Systems Journal, 15(3):3370–3381, 2020

    2020

Show all 86 references
  1. [8]

    Recon- ciling modern machine learning and the bias-variance trade-off.CoRR, abs/1812.11118, 2018

    Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. Recon- ciling modern machine learning and the bias-variance trade-off.CoRR, abs/1812.11118, 2018

    2018 arXiv

  2. [9]

    Chainabuse

    Chainabuse. Chainabuse. https://www.chainabuse.com/

  3. [10]

    A survey on ethereum systems security: Vulnerabilities, attacks, and defenses.ACM Computing Surveys (CSUR), 53(3):1–43, 2020

    Huashan Chen, Marcus Pendleton, Laurent Njilla, and Shouhuai Xu. A survey on ethereum systems security: Vulnerabilities, attacks, and defenses.ACM Computing Surveys (CSUR), 53(3):1–43, 2020

    2020

  4. [11]

    Defectchecker: Automated smart contract defect detection by analyzing EVM bytecode.IEEE Trans

    Jiachi Chen, Xin Xia, David Lo, John Grundy, Xiapu Luo, and Ting Chen. Defectchecker: Automated smart contract defect detection by analyzing EVM bytecode.IEEE Trans. Software Eng., 48(7):2189–2207, 2022

    2022

  5. [12]

    A survey of blockchain applications in different domains

    Wubing Chen, Zhiying Xu, Shuyu Shi, Yang Zhao, and Jun Zhao. A survey of blockchain applications in different domains. InProceedings of the 2018 International Conference on Blockchain Technology and Application, pages 17–21, 2018

    2018

  6. [13]

    Wide & deep learning for recommender systems

    Heng-Tze Cheng, Levent Koc, Jeremiah Harmsen, Tal Shaked, Tushar Chandra, Hrishi Aradhye, Glen Anderson, Greg Corrado, Wei Chai, Mustafa Ispir, Rohan Anil, Zakaria Haque, Lichan Hong, Vihan Jain, Xiaobing Liu, and Hemal Shah. Wide & deep learning for recommender systems. In Al...

    2016

  7. [14]

    Dominance statistics: Ordinal analyses to answer ordinal questions.Psychological Bulletin, 114(3):494–505, 1993

    Norman Cliff. Dominance statistics: Ordinal analyses to answer ordinal questions.Psychological Bulletin, 114(3):494–505, 1993

    1993

  8. [15]

    John Wiley & Sons, third edition, 1999

    William Jay Conover.Practical Nonparametric Statistics. John Wiley & Sons, third edition, 1999

    1999

  9. [16]

    Cover and P

    T. Cover and P. Hart. Nearest neighbor pattern classification.IEEE Transactions on Information Theory, 13(1):21–27, 1967

    1967

  10. [17]

    Malcon api: Advanced malicious contract detection & preven- tion

    Cyvers. Malcon api: Advanced malicious contract detection & preven- tion. https://cyvers.ai/malconapi

  11. [18]

    A survey on blockchain for big data: Approaches, opportunities, and future directions

    Natarajan Deepa, Quoc-Viet Pham, Dinh C Nguyen, Sweta Bhat- tacharya, B Prabadevi, Thippa Reddy Gadekallu, Praveen Kumar Reddy Maddikunta, Fang Fang, and Pubudu N Pathirana. A survey on blockchain for big data: Approaches, opportunities, and future directions. Future Generatio...

    2022

  12. [19]

    Statistical comparisons of classifiers over multiple data sets.J

    Janez Demsar. Statistical comparisons of classifiers over multiple data sets.J. Mach. Learn. Res., 7:1–30, 2006

    2006

  13. [20]

    An empirical evaluation of the effectiveness of smart contract verification tools

    Bruno Dia, Naghmeh Ivaki, and Nuno Laranjeiro. An empirical evaluation of the effectiveness of smart contract verification tools. In 2021 IEEE 26th Pacific Rim International Symposium on Dependable Computing (PRDC), pages 17–26. IEEE, 2021

    2021

  14. [21]

    Mythril: Security analysis tool for ethereum smart contracts

    ConsenSys Diligence. Mythril: Security analysis tool for ethereum smart contracts. https://github.com/ConsenSys/mythril. Accessed: 2024-11-25

    2024

  15. [22]

    Nonparametric pairwise multiple comparisons in inde- pendent groups using dunn’s test.The Stata Journal, 15(1):292–300, 2015

    Alexis Dinno. Nonparametric pairwise multiple comparisons in inde- pendent groups using dunn’s test.The Stata Journal, 15(1):292–300, 2015

    2015

  16. [23]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weis- senborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition ...

    2021

  17. [24]

    Multiple comparisons using rank sums.Technometrics, 6(3):241–252, 1964

    Olive Jean Dunn. Multiple comparisons using rank sums.Technometrics, 6(3):241–252, 1964

    1964

  18. [25]

    Empirical review of automated analysis tools on 47,587 ethereum smart contracts

    Thomas Durieux, João F Ferreira, Rui Abreu, and Pedro Cruz. Empirical review of automated analysis tools on 47,587 ethereum smart contracts. InProceedings of the ACM/IEEE 42nd International conference on software engineering, pages 530–541, 2020

    2020

  19. [26]

    Securing smart contracts in fog computing: Machine learning-based attack detection for registration and resource access granting.IEEE Access, 12:42802–42815, 2024

    Tahmina Ehsan, Muhammad Usman Sana, Muhammad Usman Ali, Elizabeth Caro Montero, Eduardo Silva Alvarado, Sirojiddin Djuraev, and Imran Ashraf. Securing smart contracts in fog computing: Machine learning-based attack detection for registration and resource access granting.IEEE A...

    2024

  20. [27]

    evmdasm library

    Ethereum. evmdasm library. https://github.com/ethereum/evmdasm. Accessed: 2024-11-25

    2024

  21. [28]

    Ether total supply and market capitalization chart

    Etherscan. Ether total supply and market capitalization chart. https: //etherscan.io/stat/supply. Accessed: 2025-03-28

    2025

  22. [29]

    Etherscan.io website

    Etherscan. Etherscan.io website. https://etherscan.io/. Accessed: 2024- 11-25

    2024

  23. [30]

    Evm opcodes (shanghai update)

    EVM.codes. Evm opcodes (shanghai update). https://www.evm.codes/ ?fork=shanghai. Accessed: 25-Nov-2024

    2024

  24. [31]

    Vit-base-patch16-224, 2024

    Hugging Face. Vit-base-patch16-224, 2024. Accessed: 2024-12-01

    2024

  25. [32]

    Al-spsd: Anti-leakage smart ponzi schemes detection in blockchain.Information Processing & Management, 58(4):102587, 2021

    Shuhui Fan, Shaojing Fu, Haoran Xu, and Xiaochun Cheng. Al-spsd: Anti-leakage smart ponzi schemes detection in blockchain.Information Processing & Management, 58(4):102587, 2021

    2021

  26. [33]

    Slither: A static analysis framework for smart contracts

    Josselin Feist, Gustavo Grieco, and Alex Groce. Slither: A static analysis framework for smart contracts. In2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB), pages 8–15, 2019

    2019

  27. [34]

    Codebert: A pre-trained model for programming and natural languages

    Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, and Ming Zhou. Codebert: A pre-trained model for programming and natural languages. In Trevor Cohn, Yulan He, and Yang Liu, editors,Findings of the Associatio...

    2020

  28. [35]

    The use of ranks to avoid the assumption of normality implicit in the analysis of variance.Journal of the American Statistical Association, 32(200):675–701, 1937

    Milton Friedman. The use of ranks to avoid the assumption of normality implicit in the analysis of variance.Journal of the American Statistical Association, 32(200):675–701, 1937

    1937

  29. [36]

    How effective are smart contract analysis tools? evaluating smart contract static analysis tools using bug injection

    Asem Ghaleb and Karthik Pattabiraman. How effective are smart contract analysis tools? evaluating smart contract static analysis tools using bug injection. InProceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 415– 427, 2020

    2020

  30. [38]

    Google bigquery documentation

    Google. Google bigquery documentation. https://cloud.google.com/ bigquery/docs. Accessed: 2024-11-25

    2024

  31. [39]

    Echidna: effective, usable, and fast fuzzing for smart contracts

    Gustavo Grieco, Will Song, Artur Cygan, Josselin Feist, and Alex Groce. Echidna: effective, usable, and fast fuzzing for smart contracts. In Proceedings of the 29th ACM SIGSOFT international symposium on software testing and analysis, pages 557–560, 2020

    2020

  32. [40]

    Txphishscope: Towards detecting and understanding transaction-based phishing on ethereum

    Bowen He, Yuan Chen, Zhuo Chen, Xiaohui Hu, Yufeng Hu, Lei Wu, Rui Chang, Haoyu Wang, and Yajin Zhou. Txphishscope: Towards detecting and understanding transaction-based phishing on ethereum. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Securi...

    2023

  33. [41]

    Random decision forests

    Tin Kam Ho. Random decision forests. InProceedings of 3rd Inter- national Conference on Document Analysis and Recognition, volume 1, pages 278–282 vol.1, 1995

    1995

  34. [42]

    The state of phishing attacks.Communications of the ACM, 55(1):74–81, 2012

    Jason Hong. The state of phishing attacks.Communications of the ACM, 55(1):74–81, 2012

    2012

  35. [43]

    Scsguard: Deep scam detection for ethereum smart contracts

    Huiwen Hu, Qianlan Bai, and Yuedong Xu. Scsguard: Deep scam detection for ethereum smart contracts. InIEEE INFOCOM 2022 - IEEE Conference on Computer Communications Workshops, INFOCOM 2022 - Workshops, New York, NY, USA, May 2-5, 2022, pages 1–6. IEEE, 2022

    2022

  36. [44]

    R2-D2: color-inspired convolutional neural network (cnn)-based android malware detections

    TonTon Hsien-De Huang and Hung-Yu Kao. R2-D2: color-inspired convolutional neural network (cnn)-based android malware detections. In Naoki Abe, Huan Liu, Calton Pu, Xiaohua Hu, Nesreen K. Ahmed, Mu Qiao, Yang Song, Donald Kossmann, Bing Liu, Kisung Lee, Jiliang Tang, Jingrui H...

    2018

  37. [45]

    Huggingface transformers library

    HuggingFace. Huggingface transformers library. https://huggingface.co/ docs/transformers/index

  38. [46]

    Codenet: Code-targeted convolutional neural network architecture for smart contract vulnerability detection.IEEE Access, 10:32595–32607, 2022

    Seon-Jin Hwang, Seok-Hwan Choi, Jinmyeong Shin, and Yoon-Ho Choi. Codenet: Code-targeted convolutional neural network architecture for smart contract vulnerability detection.IEEE Access, 10:32595–32607, 2022

    2022

  39. [47]

    Grim finance hacked: 600 million in crypto stolen in december

    TRM Investigations. Grim finance hacked: 600 million in crypto stolen in december. https://www.trmlabs.com/post/ grim-finance-hacked-600-million-in-crypto-stolen-in-december

  40. [48]

    Irissappane, Hanfei Yu, Yankun Shen, Anubha Agrawal, and Gray Stanton

    Athirai A. Irissappane, Hanfei Yu, Yankun Shen, Anubha Agrawal, and Gray Stanton. Leveraging GPT-2 for classifying spam reviews with limited labeled data via adversarial training.CoRR, abs/2012.13400, 2020

    2012 arXiv

  41. [49]

    A survey of ethereum smart contract security: Attacks and detection.Distrib

    Tengyun Jiao, Zhiyu Xu, Minfeng Qi, Sheng Wen, Yang Xiang, and Gary Nan. A survey of ethereum smart contract security: Attacks and detection.Distrib. Ledger Technol., 3(3), September 2024

    2024

  42. [50]

    Eth-psd: A machine learning- based phishing scam detection approach in ethereum.IEEE Access, 10:118043–118057, 2022

    Arkan Hammoodi Hasan Kabla, Mohammed Anbar, Selvakumar Man- ickam, and Shankar Karupayah. Eth-psd: A machine learning- based phishing scam detection approach in ethereum.IEEE Access, 10:118043–118057, 2022

    2022

  43. [51]

    W. H. Kruskal and W. A. Wallis. Use of ranks in one-criterion variance analysis.Journal of the American Statistical Association, 47(260):583– 621, 1952

    1952

  44. [52]

    Permutation feature importance, 2024

    Scikit learn developers. Permutation feature importance, 2024. Ac- cessed: 2025-02-24

    2024

  45. [53]

    A smart contract vulnerability detection method based on deep learning with opcode sequences, Sep 2024

    Peiqiang Li, Guojun Wang, Xiaofei Xing, Jinyao Zhu, Wanyi Gu, and Guangxin Zhai. A smart contract vulnerability detection method based on deep learning with opcode sequences, Sep 2024

    2024

  46. [54]

    Machine learning approach to identify malicious smart contract opcodes: A prelimi- nary study.JPS Conference Proceedings (Blockchain Kaigi 2023), 43:011002, 2023

    Derek Liu, Francesco Piccoli, and Victor Fang. Machine learning approach to identify malicious smart contract opcodes: A prelimi- nary study.JPS Conference Proceedings (Blockchain Kaigi 2023), 43:011002, 2023

    2023

  47. [55]

    Springer, 2001

    Jiming Liu and Yiming Ye.Introduction to e-commerce agents: Mar- ketplace marketplace solutions, security issues, and supply and demand. Springer, 2001

    2001

  48. [56]

    Shuai Lu, Daya Guo, Shuo Ren, Junjie Huang, Alexey Svyatkovskiy, Ambrosio Blanco, Colin B. Clement, Dawn Drain, Daxin Jiang, Duyu Tang, Ge Li, Lidong Zhou, Linjun Shou, Long Zhou, Michele Tufano, Ming Gong, Ming Zhou, Nan Duan, Neel Sundaresan, Shao Kun Deng, Shengyu Fu, and S...

    2021

  49. [57]

    Lundberg and Su-In Lee

    Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In Isabelle Guyon, Ulrike von Luxburg, Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V . N. Vishwanathan, and Roman Garnett, editors,Advances in Neural Information Processing Systems 30: Ann...

    2017

  50. [58]

    Document ranking with a pretrained sequence-to-sequence model

    Rodrigo Frassetto Nogueira, Zhiying Jiang, Ronak Pradeep, and Jimmy Lin. Document ranking with a pretrained sequence-to-sequence model. In Trevor Cohn, Yulan He, and Yang Liu, editors,Findings of the Association for Computational Linguistics: EMNLP 2020, Online Event, 16-20 No...

    2020

  51. [59]

    Smart contract vulnerability detection using wide and deep neural network

    Samuel Banning Osei, Zhongchen Ma, and Rubing Huang. Smart contract vulnerability detection using wide and deep neural network. Science of Computer Programming, 238:103172, 2024

    2024

  52. [60]

    Regularized target encoding outperforms traditional methods in super- vised machine learning with high cardinality features.Comput

    Florian Pargent, Florian Pfisterer, Janek Thomas, and Bernd Bischl. Regularized target encoding outperforms traditional methods in super- vised machine learning with high cardinality features.Comput. Stat., 37(5):2671–2692, 2022

    2022

  53. [61]

    A formal verification tool for ethereum vm bytecode

    Daejun Park, Yi Zhang, Manasvi Saxena, Philip Daian, and Grigore Ro¸ su. A formal verification tool for ethereum vm bytecode. In Proceedings of the 2018 26th ACM joint meeting on european software engineering conference and symposium on the foundations of software engineering,...

    2018

  54. [62]

    TESSERACT: eliminating experimental bias in malware classification across space and time

    Feargus Pendlebury, Fabio Pierazzi, Roberto Jordaney, Johannes Kinder, and Lorenzo Cavallaro. TESSERACT: eliminating experimental bias in malware classification across space and time. In Nadia Heninger and Patrick Traynor, editors,28th USENIX Security Symposium, USENIX Securit...

    2019

  55. [63]

    Smart contract vulnerabilities: Vul- nerable does not imply exploited

    Daniel Perez and Benjamin Livshits. Smart contract vulnerabilities: Vul- nerable does not imply exploited. In30th USENIX Security Symposium (USENIX Security 21), pages 1325–1341, 2021

    2021

  56. [64]

    Erc-1167: Minimal proxy contract

    Ethereum Improvement Proposals. Erc-1167: Minimal proxy contract. https://eips.ethereum.org/EIPS/eip-1167/. Accessed: 2024-11-25

    2024

  57. [65]

    Peng Qian, Jianting He, Lingling Lu, Siwei Wu, Zhipeng Lu, Lei Wu, Yajin Zhou, and Qinming He. Demystifying random number in ethereum smart contract: taxonomy, vulnerability identification, and attack detec- tion.IEEE Transactions on Software Engineering, 49(7):3793–3810, 2023

    2023

  58. [66]

    Towards automated reentrancy detection for smart contracts based on sequential models.IEEE Access, 8:19685–19695, 2020

    Peng Qian, Zhenguang Liu, Qinming He, Roger Zimmermann, and Xun Wang. Towards automated reentrancy detection for smart contracts based on sequential models.IEEE Access, 8:19685–19695, 2020

    2020

  59. [67]

    Language models are unsupervised multitask learners.OpenAI blog, 1(8):9, 2019

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners.OpenAI blog, 1(8):9, 2019

    2019

  60. [68]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer.J. Mach. Learn. Res., 21:140:1–140:67, 2020

    2020

  61. [69]

    Typosquat campaign tar- geting npm developers

    Phylum Research. Typosquat campaign tar- geting npm developers. https://blog.phylum.io/ supply-chain-security-typosquat-campaign-targeting-puppeteer-users/

  62. [70]

    Phishinghook: Catching phishing ethereum smart contracts leveraging evm opcodes

    Pasquale De Rosa, Simon Queyrut, Yerom-David Bromberg, Pascal Fel- ber, and Valerio Schiavoni. Phishinghook: Catching phishing ethereum smart contracts leveraging evm opcodes. https://doi.org/10.5281/zenodo. 14260284, Mar 2025

    doi

  63. [71]

    Accessed: 2024-12-01

    The scikit-learn developers.Supervised Learning - scikit-learn 1.5.0 documentation, 2024. Accessed: 2024-12-01

    2024

  64. [72]

    Smarter contracts: Detecting vulnerabilities in smart contracts with deep transfer learning

    Christoph Sendner, Huili Chen, Hossein Fereidooni, Lukas Petzi, Jan König, Jasper Stang, Alexandra Dmitrienko, Ahmad-Reza Sadeghi, and Farinaz Koushanfar. Smarter contracts: Detecting vulnerabilities in smart contracts with deep transfer learning. InProceedings of the Network ...

    2023

  65. [73]

    S. S. Shapiro and M. B. Wilk. An analysis of variance test for normality (complete samples).Biometrika, 52(3-4):591–611, 12 1965

    1965

  66. [74]

    Understanding the dao attack

    David Siegel. Understanding the dao attack. https://www.coindesk.com/ learn/understanding-the-dao-attack

  67. [75]

    Solidity language documentation

    Solidity Team. Solidity language documentation. https://soliditylang. org/. Accessed: 25-Nov-2024

    2024

  68. [76]

    Securify 2.0

    ETH Zurich SRI Lab. Securify 2.0. https://github.com/eth-sri/securify2. Accessed: 2025-03-28

    2025

  69. [77]

    Mingxing Tan and Quoc V . Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors,Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, Cali- fo...

    2019

  70. [78]

    The art of the scam: Demystifying honeypots in ethereum smart contracts

    Christof Ferreira Torres, Mathis Steichen, and Radu State. The art of the scam: Demystifying honeypots in ethereum smart contracts. In28th USENIX Security Symposium (USENIX Security 19), pages 1591–1607, Santa Clara, CA, August 2019. USENIX Association

    2019

  71. [79]

    Survey of machine learning techniques for malware analysis.Computers & Security, 81:123–147, 2019

    Daniele Ucci, Leonardo Aniello, and Roberto Baldoni. Survey of machine learning techniques for malware analysis.Computers & Security, 81:123–147, 2019

    2019

  72. [80]

    Mitigating frontrunning attacks in ethereum

    Maddipati Varun, Balaji Palanisamy, and Shamik Sural. Mitigating frontrunning attacks in ethereum. InProceedings of the Fourth ACM International Symposium on Blockchain and Secure Critical Infrastruc- ture, pages 115–124, 2022

    2022

  73. [81]

    Viper language documentation

    Vyper Project. Viper language documentation. https://docs.vyperlang. org/en/stable/. Accessed: 25-Nov-2024

    2024

  74. [82]

    Eca-net: Efficient channel attention for deep convolutional neural networks

    Qilong Wang, Banggu Wu, Pengfei Zhu, Peihua Li, Wangmeng Zuo, and Qinghua Hu. Eca-net: Efficient channel attention for deep convolutional neural networks. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, page...

    2020

  75. [83]

    Individual comparisons by ranking methods.Biomet- rics Bulletin, 1(6):80–83, 1945

    Frank Wilcoxon. Individual comparisons by ranking methods.Biomet- rics Bulletin, 1(6):80–83, 1945

    1945

  76. [84]

    Ethereum: A secure decentralised generalised transaction ledger (shangai version).Ethereum project yellow paper, pages 1–42, 2024

    Gavin Wood. Ethereum: A secure decentralised generalised transaction ledger (shangai version).Ethereum project yellow paper, pages 1–42, 2024

    2024

  77. [85]

    The detection of fraudulent smart contracts based on eca-efficientnet and data enhancement.Computers, Materials and Continua, 77(3):4073–4087, 2023

    Xuanchen Zhou, Wenzhong Yang, Liejun Wang, Fuyuan Wei, KeZiEr- BieKe HaiLaTi, and Yuanyuan Liao. The detection of fraudulent smart contracts based on eca-efficientnet and data enhancement.Computers, Materials and Continua, 77(3):4073–4087, 2023

    2023

  78. [746]

    USENIX Association, 2019

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.