Pith. sign in

REVIEW 4 major objections 5 minor 58 references

SmartDetector claims to spot cloned smart contract functions with 95.88% average F1 and pinpoint the copied lines.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 18:44 UTC pith:HN2LWXMI

load-bearing objection Useful statement-level decomposition and a reusable dataset, but the headline F1 is built on shaky label heuristics and non-reconstructible averages. the 4 major comments →

arxiv 2509.09630 v1 pith:HN2LWXMI submitted 2025-09-11 cs.SE cs.CR

I Know Who Clones Your Code: Interpretable Smart Contract Similarity Detection

Zhenguang Liu , Lixun Ma , Zhongzheng Mu , Chengkun Wei , Xiaojun Xu , Yingying Jiao , Kui Ren This is my paper
classification cs.SE cs.CR
keywords smart contractcode clone detectionabstract syntax treestatement treesimilarity detectioninterpretabilityhyperparameter optimizationEthereum
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Smart contract code is heavily reused, and cloned code carries bugs. The paper introduces SmartDetector, a method that decides whether two smart contract functions are clones by splitting each function's abstract syntax tree into small statement trees, comparing every statement tree from one function with every statement tree from the other, and aggregating the pair scores. It reports that this approach beats nine existing methods on Ethereum, Binance Smart Chain, and Polygon datasets, averaging 95.88% F1-score, and that the comparison matrix doubles as an explanation: users see which line numbers are similar. A derived cosine-wise diffusion process searches the classifier's hyperparameters without a grid sweep. If the result holds, security auditors gain an interpretable clone detector that can flag vulnerable copied functions before deployment.

Core claim

The central claim is that function-level clone detection becomes both more accurate and explainable when the unit of comparison is the statement. SmartDetector decomposes each function AST into six types of statement trees, extracts seven category-level node features (arithmetic operator, member variable, value, identifier, unit, data type, code construct), and feeds pairs of statement trees to a gradient-boosting classifier with diffusion-searched hyperparameters. Function similarity is the proportion of statement trees in either function that match the other, judged against a threshold of 0.7. The paper reports F1 of 92.79% on Ethereum function pairs, 99.01% on a third-party labeled datase

What carries the argument

Statement tree: a subtree of the function's AST corresponding to one line of code or one loop block, categorized into six types (variable definition, assignment, conditional block, control loop, function call, other). The method compares every statement tree pair of two functions and aggregates the matrix; because each statement tree maps to source line numbers, the similarity matrix yields line-level localization. The second piece is the cosine-wise diffusion sampler, a derivable Markov chain that generates candidate hyperparameters around promising seeds for the gradient-boosting classifier.

Load-bearing premise

The labeled datasets are built from heuristic pre-labeling (distinct groups as negatives, same-fork counterparts as positives) that was only partly manually verified; if those heuristic labels correlate with the same syntactic features the detector uses, the measured F1 may overstate hard clone-detection ability.

What would settle it

Take a random sample of the FC-pairs and ST-pairs test sets, have several independent Solidity developers label each pair as clone or non-clone without seeing the heuristic grouping, and compare their labels with the original. If agreement is low, or if SmartDetector's accuracy on pairs that the heuristics marked as borderline is near chance, the headline F1 overstates the true detection rate.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If the 95.88% average F1 holds, auditors can run clone detection over contract repositories and get line-numbered reports of copied code, reducing manual triage.
  • Because the method matches statement trees pairwise and aggregates with an OR-threshold, reordering statements does not break detection.
  • Feature-weight analysis shows data-type and arithmetic-operator nodes matter most, indicating that variable renaming and identifier changes are handled well.
  • The reported speed (0.2 ms per function pair, 842 s training, 29 s testing) suggests deployment at Ethereum scale is feasible.
  • The panorama of 347k Ethereum functions grouped into 14,345 template groups quantifies the clone phenomenon and can prioritize templates for vulnerability review.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The ground-truth labels may encode the same heuristic signals the detector exploits; an independent human re-labeling of a random sample would test whether the high F1 reflects clone detection or easy separation of obviously different functions.
  • The statement-tree representation could generalize to other EVM languages and to non-contract Solidity libraries, and even to other structured languages with similar ASTs.
  • Because the report links similar lines, the output could be extended to auto-triaged vulnerability propagation by propagating a known vulnerability label from one function to similar counterpart lines.
  • The diffusion hyperparameter sampler is generic; it could in principle be applied to other gradient-boosting or tree-ensemble classifiers beyond this setting.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes SmartDetector, an interpretable method for smart-contract function similarity detection. It decomposes each function's AST into statement trees, extracts seven category-level features, and uses a LightGBM classifier (Smart-lightGBM) trained on statement-tree pairs to produce a function-level similarity score with statement-level localization. A cosine-wise diffusion process is derived to sample classifier hyperparameters. The authors claim an average F1 of 95.88% and an average improvement of 14.01% over nine baselines on Ethereum (FC-pairs, ST-pairs), BSC/Polygon (CP-pairs), and an external dataset (BL-pairs), and they release code and datasets.

Significance. If the empirical claims hold, SmartDetector would be a practical, interpretable clone detector for smart contracts, with a useful line-level explanation mechanism and a large public dataset. The paper's strengths include a large-scale evaluation (over 1.79 million statement-tree pairs), release of code/data, and a concrete interpretability output. However, several load-bearing issues—unquantified heuristic labeling, non-reconstructible headline aggregate metrics, and a mathematically incorrect aggregation formula—currently weaken the central empirical claims.

major comments (4)
  1. [Abstract; §VIII-C, Table III] The headline '95.88% average F1' is not reconstructible. Table III gives FC-pairs F1=92.79 and BL-pairs F1=99.01; the CP-pairs paragraph reports F1=92.1. The average of the two table values is 95.90, and the average of all three is 94.63, neither equal to 95.88. The claimed '14.01% average improvement' is the average of the FC improvement over SRCL (92.79−83.48=9.31) and the BL improvement over SmartEmbed (99.01−80.31=18.70); CP-pairs has no baseline comparisons. Please state exactly which datasets are averaged and add baselines on CP-pairs.
  2. [§VIII-A] The FC-pairs and ST-pairs labels are generated by hybrid heuristics: pairs across heuristic groups become high-confidence negatives and same-fork counterpart functions become pre-labeled positives, 'manually verified afterward.' No inter-annotator agreement, no proportion of pairs verified, and no operationalization of 'significant functional differences' are reported. Because SmartDetector's features are derived from AST structure, these heuristics may codify the same syntactic cues the classifier exploits, so the reported F1 may measure easy separability rather than hard clone detection. This is load-bearing because FC/ST-pairs are the main training/test sets and BL-pairs is small (152 positive pairs). Please report the verification protocol, quantify agreement, and evaluate on hard negatives (e.g., same-project pairs or semantic-preserving transformations).
  3. [§VII-C, Eq. (13)] The function-level aggregation scores s_A and s_B are not proportions. s_A = (1/m)∑_{i,j} R_{ij} can exceed 1 because each row sum can be as large as n; for example, with m=1, n=2 and R=[1,1], s_A=2. Thus the decision rule with threshold δ=0.7 is not a proportion threshold and may be trivially satisfied for small-function/large-function pairs. Please replace this with a bounded aggregation (e.g., row-wise max or a matching-based count) and re-run the evaluation.
  4. [§VIII-B, Table III] The text states 'we repeat ten times for each experiment and report the averaged results,' but Table III reports no standard deviations and no significance tests. Consequently, the claim that SmartDetector 'consistently and significantly outperforms' baselines is not supported by the reported evidence. Please add variance estimates and significance tests, or explicitly state that the differences were not tested.
minor comments (5)
  1. [§VI, Eqs. (2)–(12)] The cosine schedule g_t = cos^2(π/2 · Δt/(T−1)) decreases with t, which is the reverse of a standard noise-increase diffusion schedule. Please clarify the direction of the process and how the continuous diffusion samples are mapped to the discrete hyperparameters of LightGBM.
  2. [Table II] CP-pairs clone counts in the text (1,673) do not match the table's clone counts (1,338 + 334 = 1,672). Please correct the inconsistency.
  3. [§VIII-F] The description of SmartDetector-WFE says 'rely solely on statement trees as inputs,' but a tree cannot be directly fed to LightGBM. Please clarify what features are used in this ablation.
  4. [Figure 6] The simplified similarity report is confusing because the line-number mapping between function A and function B is not visually clear. Please reformat the table so each row maps one line from A to one line from B.
  5. [General] The project URL and some text use 'SmartDetecter' while the method is named 'SmartDetector.' Please standardize naming.

Circularity Check

0 steps flagged

No significant circularity found; the smart-contract similarity pipeline is self-contained and benchmarked against an external dataset.

full rationale

The central derivation chain is not circular. SmartDetector decomposes ASTs into statement trees, extracts seven category-level features, trains a LightGBM classifier on statement-tree pair labels, and aggregates statement-tree similarities into a function-level prediction. The classifier and aggregation are defined independently of the evaluation labels. The diffusion-based hyperparameter search minimizes cross-entropy loss on a validation set, which is standard model selection rather than a fitted parameter disguised as a prediction. The similarity threshold is selected on the ST-pairs data and then applied to held-out function pairs; this is threshold tuning, not a construction that forces the reported F1. The BL-pairs dataset is an external benchmark, providing independent evidence for the central claim. The FC-pairs and ST-pairs labels are generated with heuristic assistance and manual verification, which raises a data-quality concern (easy separability), but that concern concerns labeling validity, not a logical circularity in which the outputs are equivalent to the inputs by construction. No self-citation is load-bearing, and no uniqueness theorem or prior-work ansatz is invoked to force the method's design. Therefore the paper does not exhibit circular reasoning under the definitions used here.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The method's success depends on three externally supplied assumptions: the correctness of the human and heuristic clone labels, the preservation of semantics when an AST is cut into statement trees, and the validity of the row and column average aggregation with a single threshold. A fourth assumption, that Gaussian perturbation around seed hyperparameters finds low-loss configurations, is asserted rather than proved. No new physical entity or external falsifiable object is introduced.

free parameters (3)
  • similarity threshold delta = 0.7
    Chosen on ST-pairs by sweeping delta from 0.5 to 0.9 (Section VIII-B, Figure 7); applied to all function-level clone decisions.
  • Smart-lightGBM hyperparameters = not reported
    Seven hyperparameters targeted by the cosine-wise diffusion search (e.g., num_leaves, max_depth); final values are not listed in the paper.
  • seed count k for hyperparameter evaluation network = 5,000
    Number of randomly sampled hyperparameter points used to train the evaluation network (Section VI).
axioms (5)
  • domain assumption Statement trees extracted via post-order traversal preserve the semantic content needed to decide function similarity
    Section V; the whole approach depends on this decomposition not losing meaning.
  • domain assumption Labels in FC-pairs and ST-pairs, generated by heuristic group-based pre-labeling plus manual verification, are correct ground truth
    Section VIII-A; all F1 numbers depend on label quality.
  • domain assumption Function-level similarity can be decided by averaging statement-pair probabilities and thresholding with delta = 0.7
    Equation (13) and Section VIII-B; no calibration or error analysis is given for this aggregation.
  • ad hoc to paper Gaussian perturbation around seed hyperparameters with the cosine schedule generates low-cross-entropy hyperparameters
    Section VI; the derivation yields a sampling distribution, not a guarantee of optimality.
  • standard math Independent Gaussian noises combine additively in variance (DDPM forward chain)
    Equations (6)-(12); this part is correct but standard.

pith-pipeline@v1.3.0-alltime-deepseek · 24433 in / 14911 out tokens · 161259 ms · 2026-08-04T18:44:47.324640+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of I Know Who Clones Your Code: Interpretable Smart Contract Similarity Detection." pith.science (2026). https://pith.science/paper/HN2LWXMI

@misc{pith2026250909630,
  author       = {Pith},
  title        = {Pith review of: I Know Who Clones Your Code: Interpretable Smart Contract Similarity Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HN2LWXMI}},
  note         = {Machine review of arXiv:2509.09630}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Widespread reuse of open-source code in smart contract development boosts programming efficiency but significantly amplifies bug propagation across contracts, while dedicated methods for detecting similar smart contract functions remain very limited. Conventional abstract-syntax-tree (AST) based methods for smart contract similarity detection face challenges in handling intricate tree structures, which impedes detailed semantic comparison of code. Recent deep-learning based approaches tend to overlook code syntax and detection interpretability, resulting in suboptimal performance. To fill this research gap, we introduce SmartDetector, a novel approach for computing similarity between smart contract functions, explainable at the fine-grained statement level. Technically, SmartDetector decomposes the AST of a smart contract function into a series of smaller statement trees, each reflecting a structural element of the source code. Then, SmartDetector uses a classifier to compute the similarity score of two functions by comparing each pair of their statement trees. To address the infinite hyperparameter space of the classifier, we mathematically derive a cosine-wise diffusion process to efficiently search optimal hyperparameters. Extensive experiments conducted on three large real-world datasets demonstrate that SmartDetector outperforms current state-of-the-art methods by an average improvement of 14.01% in F1-score, achieving an overall average F1-score of 95.88%.

Figures

Figures reproduced from arXiv: 2509.09630 by Chengkun Wei, Kui Ren, Lixun Ma, Xiaojun Xu, Yingying Jiao, Zhenguang Liu, Zhongzheng Mu.

Figure 1
Figure 1. Figure 1: Five most frequently reused templates. information about the smart contract code structure and syntax. SmartEmbed [11] serializes and encodes the nodes of AST into a stream of tokens, stacking them into a matrix for similarity detection. SRCL [12] learns local and global information from AST by utilizing Transformer and CNN encoders. Upon investigating and experimenting with the released code of state-of-t… view at source ↗
Figure 2
Figure 2. Figure 2: Panorama of Ethereum code cloning phenomenon. II. RELATED WORK A. Code Clone Detection for Traditional Language Code clone detection is widely recognized as one of the most critical issues in the field of software engineering. Code clone detection for traditional language has consistently attracted significant attention due to its substantial impact on code quality, maintainability, and overall software de… view at source ↗
Figure 3
Figure 3. Figure 3: The original BEC transfer function and a plagia￾rized function from it. million from Fomo3D by exploiting this vulnerability. Almost all the awkward imitators were also exposed to those attacks due to code plagiarism. LastWinner [50], one of the most successful imitators of Fomo3D, was attacked later, incurring a loss of 12,948 ETH, valued at $18 million [51]. Code Clone in DeFi. BEC (Beautiful Ecological … view at source ↗
Figure 4
Figure 4. Figure 4: The original BEC transfer function and a plagiarized function of it. structures. For example, [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: The workflow of SmartDetector in identifying the similarity between two smart contract functions. a method to extract seven types of category features based on statement trees and assign weights to each of them for similarity detection. IV. METHOD OVERVIEW Up to now, we have introduced two examples to help understand the problem, and explained the motivation of this paper. In this section, we formulate the… view at source ↗
Figure 6
Figure 6. Figure 6: A simplified similarity detection report. This code clone line localization capability ensures the interpretability of the detection results, providing clear and precise guidance for subsequent code review and security analysis. VIII. EVALUATION In this section, we conduct comprehensive experiments to evaluate the proposed method. Overall, we seek to answer the following research questions: • RQ1: Can SMAR… view at source ↗
Figure 7
Figure 7. Figure 7: Effect of the similarity threshold δ. Comparison with graph-based methods. We first com￾pare our method with four state-of-the-art graph-based code similarity detection methods, which include: • Eclone [10]: A semantic clone detector for Ethereum smart contracts. It captures the high-level semantics of a smart contract using symbolic transaction sketches, and combines them with other syntactic information … view at source ↗
Figure 8
Figure 8. Figure 8: Two transfer functions, one written in high-level Solidity and the other using inline assembly. The inline assembly version leads to a false negative in similarity detection due to differences in AST representations. low rewards and minor penalties, while the second employs a 90-day lock with higher rewards and severe penalties, posi￾tioning it as a high-risk, high-reward product. These parameter differenc… view at source ↗
Figure 9
Figure 9. Figure 9 [PITH_FULL_IMAGE:figures/full_fig_p014_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Time performance on FC-pairs dataset. explain how statement trees align with corresponding lines in code. 2) We show the weights of the seven category-level features (see sections VII-A and VII-B for details) in the Smart-lightGBM classifier. Interpretability at the statement Level. The interpretabil￾ity of SMARTDETECTOR is rooted in our abstract syntax tree (i.e., AST) division strategy. This strategy de… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

58 extracted references · 2 linked inside Pith

  1. [1]

    Smart contract development: Challenges and opportunities,

    W. Zou, D. Lo, P. S. Kochhar, X.-B. D. Le, X. Xia, Y . Feng, Z. Chen, and B. Xu, “Smart contract development: Challenges and opportunities,” IEEE Transactions on Software Engineering, vol. 47, no. 10, pp. 2084– 2106, 2019

    2084

  2. [2]

    Com- bining graph neural networks with expert knowledge for smart contract vulnerability detection,

    Z. Liu, P. Qian, X. Wang, Y . Zhuang, L. Qiu, and X. Wang, “Com- bining graph neural networks with expert knowledge for smart contract vulnerability detection,”IEEE Transactions on Knowledge and Data Engineering, 2021

    2021

  3. [3]

    Characterizing code clones in the ethereum smart contract ecosystem,

    N. He, L. Wu, H. Wang, Y . Guo, and X. Jiang, “Characterizing code clones in the ethereum smart contract ecosystem,” inFinancial Cryptography and Data Security: 24th International Conference, FC 2020, Kota Kinabalu, Malaysia, February 10–14, 2020 Revised Selected Papers 24. Springer, 2020, pp. 654–675

    2020

  4. [4]

    Smart contract market size,

    V . Report, “Smart contract market size,” 2021, https://reports.valuates. com/market-reports/QYRE-Auto-31L1599/global-smart-contracts/

    2021

  5. [5]

    Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection,

    L. Luo, J. Ming, D. Wu, P. Liu, and S. Zhu, “Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection,” inProceedings of the 22nd ACM SIG- SOFT international symposium on foundations of software engineering, 2014, pp. 389–400

    2014

  6. [6]

    Compuware-ibm lawsuit,

    Compuware-IBM Lawsuit, “Compuware-ibm lawsuit,” http://news. zdnet.com/2100-3513 22-5629876.html, 2013, [Online; accessed 10- July-2025]

    2013

  7. [7]

    KoET, 2017, https://www.kingoftheether.com/thrones/kingoftheether/ index.html

    2017

  8. [8]

    The biggest crowdfunding project ever—the dao—is kind of a mess,

    C. Metz, “The biggest crowdfunding project ever—the dao—is kind of a mess,” 2017, https://www.wired.com/2016/06/ biggest-crowdfunding-project-ever-dao-mess/

    2017

  9. [9]

    V olcano: Detecting vulnerabilities of ethereum smart contracts using code clone analysis,

    N. F. Samreen and M. H. Alalfi, “V olcano: Detecting vulnerabilities of ethereum smart contracts using code clone analysis,”arXiv preprint arXiv:2203.00769, 2022

    Pith/arXiv arXiv 2022

  10. [10]

    Eclone: Detect semantic clones in ethereum via symbolic transaction sketch,

    H. Liu, Z. Yang, C. Liu, Y . Jiang, W. Zhao, and J. Sun, “Eclone: Detect semantic clones in ethereum via symbolic transaction sketch,” in Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2018, pp. 900–903

    2018

  11. [11]

    Smartembed: A tool for clone and bug detection in smart contracts through structural code embedding,

    Z. Gao, V . Jayasundara, L. Jiang, X. Xia, D. Lo, and J. Grundy, “Smartembed: A tool for clone and bug detection in smart contracts through structural code embedding,” in2019 IEEE International Con- ference on Software Maintenance and Evolution (ICSME). IEEE, 2019, pp. 394–397

    2019

  12. [12]

    Self-supervised learning of smart contract representations,

    S. Yang, X. Gu, and B. Shen, “Self-supervised learning of smart contract representations,” inProceedings of the 30th IEEE/ACM International Conference on Program Comprehension, 2022, pp. 82–93

    2022

  13. [13]

    Source code files as structured documents,

    J. I. Maletic, M. L. Collard, and A. Marcus, “Source code files as structured documents,” inProceedings 10th International Workshop on Program Comprehension. IEEE, 2002, pp. 289–292

    2002

  14. [14]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems, vol. 33, pp. 6840– 6851, 2020

    2020

  15. [15]

    Multi-threshold token-based code clone detection,

    Y . Golubev, V . Poletansky, N. Povarov, and T. Bryksin, “Multi-threshold token-based code clone detection,” in2021 IEEE International Con- ference on Software Analysis, Evolution and Reengineering (SANER). IEEE, 2021, pp. 496–500

    2021

  16. [16]

    Incremental clone detection,

    N. G ¨ode and R. Koschke, “Incremental clone detection,” in2009 13th European conference on software maintenance and reengineering. IEEE, 2009, pp. 219–228

    2009

  17. [17]

    Cclearner: A deep learning-based clone detection approach,

    L. Li, H. Feng, W. Zhuang, N. Meng, and B. Ryder, “Cclearner: A deep learning-based clone detection approach,” in2017 IEEE international conference on software maintenance and evolution (ICSME). IEEE, 2017, pp. 249–260

    2017

  18. [18]

    Ccaligner: a token based large-gap clone detector,

    P. Wang, J. Svajlenko, Y . Wu, Y . Xu, and C. K. Roy, “Ccaligner: a token based large-gap clone detector,” inProceedings of the 40th International Conference on Software Engineering, 2018, pp. 1066–1077

    2018

  19. [19]

    Ccfinder: A multilinguistic token-based code clone detection system for large scale source code,

    T. Kamiya, S. Kusumoto, and K. Inoue, “Ccfinder: A multilinguistic token-based code clone detection system for large scale source code,” IEEE transactions on software engineering, vol. 28, no. 7, pp. 654–670, 2002

    2002

  20. [20]

    Cp-miner: Finding copy-paste and related bugs in large-scale software code,

    Z. Li, S. Lu, S. Myagmar, and Y . Zhou, “Cp-miner: Finding copy-paste and related bugs in large-scale software code,”IEEE Transactions on software Engineering, vol. 32, no. 3, pp. 176–192, 2006

    2006

  21. [21]

    Sourcerercc: Scaling code clone detection to big-code,

    H. Sajnani, V . Saini, J. Svajlenko, C. K. Roy, and C. V . Lopes, “Sourcerercc: Scaling code clone detection to big-code,” inProceedings of the 38th International Conference on Software Engineering, 2016, pp. 1157–1168

    2016

  22. [22]

    Achieving accuracy and scalability simultaneously in detecting application clones on android markets,

    K. Chen, P. Liu, and Y . Zhang, “Achieving accuracy and scalability simultaneously in detecting application clones on android markets,” in Proceedings of the 36th International Conference on Software Engineer- ing, 2014, pp. 175–186

    2014

  23. [23]

    Identifying similar code with program dependence graphs,

    J. Krinke, “Identifying similar code with program dependence graphs,” inProceedings eighth working conference on reverse engineering. IEEE, 2001, pp. 301–309

    2001

  24. [24]

    Ccsharp: An efficient three-phase code clone detector using modified pdgs,

    M. Wang, P. Wang, and Y . Xu, “Ccsharp: An efficient three-phase code clone detector using modified pdgs,” in2017 24th Asia-Pacific Software Engineering Conference (APSEC). IEEE, 2017, pp. 100–109

    2017

  25. [25]

    Ccgraph: a pdg-based code clone detector with approximate graph matching,

    Y . Zou, B. Ban, Y . Xue, and Y . Xu, “Ccgraph: a pdg-based code clone detector with approximate graph matching,” inProceedings of the 35th IEEE/ACM international conference on automated software engineering, 2020, pp. 931–942

    2020

  26. [26]

    Using slicing to identify duplication in source code,

    R. Komondoor and S. Horwitz, “Using slicing to identify duplication in source code,” inInternational static analysis symposium. Springer, 2001, pp. 40–56

    2001

  27. [27]

    Neural network- based graph embedding for cross-platform binary code similarity detec- tion,

    X. Xu, C. Liu, Q. Feng, H. Yin, L. Song, and D. Song, “Neural network- based graph embedding for cross-platform binary code similarity detec- tion,” inProceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 363–376

    2017

  28. [28]

    Deepsim: deep learning code functional simi- larity,

    G. Zhao and J. Huang, “Deepsim: deep learning code functional simi- larity,” inProceedings of the 2018 26th ACM joint meeting on european software engineering conference and symposium on the foundations of software engineering, 2018, pp. 141–151

    2018

  29. [29]

    Fcca: Hybrid code representation for functional clone detection using attention networks,

    W. Hua, Y . Sui, Y . Wan, G. Liu, and G. Xu, “Fcca: Hybrid code representation for functional clone detection using attention networks,” IEEE Transactions on Reliability, vol. 70, no. 1, pp. 304–318, 2020

    2020

  30. [30]

    Treecen: Building tree graph for scalable semantic code clone detection,

    Y . Hu, D. Zou, J. Peng, Y . Wu, J. Shan, and H. Jin, “Treecen: Building tree graph for scalable semantic code clone detection,” inProceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, 2022, pp. 1–12

    2022

  31. [31]

    Clone detection using abstract syntax suffix trees,

    R. Koschke, R. Falke, and P. Frenzel, “Clone detection using abstract syntax suffix trees,” in2006 13th Working Conference on Reverse Engineering. IEEE, 2006, pp. 253–262

    2006

  32. [32]

    Clone detection in source code by frequent itemset techniques,

    V . Wahler, D. Seipel, J. Wolff, and G. Fischer, “Clone detection in source code by frequent itemset techniques,” inSource code analysis and manipulation, fourth IEEE international workshop on. IEEE, 2004, pp. 128–135

    2004

  33. [33]

    Supervised deep features for software functional clone detection by exploiting lexical and syntactical information in source code

    H. Wei and M. Li, “Supervised deep features for software functional clone detection by exploiting lexical and syntactical information in source code.” inIJCAI, 2017, pp. 3034–3040

    2017

  34. [34]

    Detecting semantic code clones by building ast-based markov chains model,

    Y . Wu, S. Feng, D. Zou, and H. Jin, “Detecting semantic code clones by building ast-based markov chains model,” inProceedings of the 37th IEEE/ACM International Conference on Automated Software Engineer- ing, 2022, pp. 1–13

    2022

  35. [35]

    A novel neural source code representation based on abstract syntax tree,

    J. Zhang, X. Wang, H. Zhang, H. Sun, K. Wang, and X. Liu, “A novel neural source code representation based on abstract syntax tree,” in 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE). IEEE, 2019, pp. 783–794

    2019

  36. [36]

    Clone detection using abstract syntax trees,

    I. D. Baxter, A. Yahin, L. Moura, M. Sant’Anna, and L. Bier, “Clone detection using abstract syntax trees,” inProceedings. International Conference on Software Maintenance (Cat. No. 98CB36272). IEEE, 1998, pp. 368–377

    1998

  37. [37]

    Scalable detection of semantic clones,

    M. Gabel, L. Jiang, and Z. Su, “Scalable detection of semantic clones,” inProceedings of the 30th international conference on Software engi- neering, 2008, pp. 321–330

    2008

  38. [38]

    Deckard: Scalable and accurate tree-based detection of code clones,

    L. Jiang, G. Misherghi, Z. Su, and S. Glondu, “Deckard: Scalable and accurate tree-based detection of code clones,” in29th International Conference on Software Engineering (ICSE’07). IEEE, 2007, pp. 96– 105

    2007

  39. [39]

    code2vec: Learning distributed representations of code,

    U. Alon, M. Zilberstein, O. Levy, and E. Yahav, “code2vec: Learning distributed representations of code,”Proceedings of the ACM on Pro- gramming Languages, vol. 3, no. POPL, pp. 1–29, 2019

    2019

  40. [40]

    Zc 3: Zero-shot cross-language code clone detection,

    J. Li, C. Tao, Z. Jin, F. Liu, and G. Li, “Zc 3: Zero-shot cross-language code clone detection,” in2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2023, pp. 875–887

    2023

  41. [41]

    Codebert: A pre-trained model for programming and natural languages,

    Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jianget al., “Codebert: A pre-trained model for programming and natural languages,”arXiv preprint arXiv:2002.08155, 2020. IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 18

    Pith/arXiv arXiv 2002

  42. [42]

    Rethinking smart contract fuzzing: Fuzzing with invocation ordering and important branch revisiting,

    Z. Liu, P. Qian, J. Yang, L. Liu, X. Xu, Q. He, and X. Zhang, “Rethinking smart contract fuzzing: Fuzzing with invocation ordering and important branch revisiting,”IEEE Transactions on Information Forensics and Security, vol. 18, pp. 1237–1251, 2023

    2023

  43. [43]

    fomo3d website, 2018, http://https://exitscam.me/

    O. fomo3d website, 2018, http://https://exitscam.me/

    2018

  44. [44]

    FoMoJP, 2018, https://etherscan.io/address/ 0xCb47C89CB17C10B719FC5eD9665bAE157CAc2cb1

    2018

  45. [45]

    RatScam, 2018, https://etherscan.io/address/ 0x8a883a20940870Dc055F2070ac8eC847ed2d9918

    2018

  46. [46]

    SuperCard, 2018, https://etherscan.io/address/ 0x29488e24cFdAA52a0b837217926C0c0853Db7962

    2018

  47. [47]

    FoMoGame, 2018, https://etherscan.io/address/ 0x5D0d76787D9d564061dD23f8209F804a3b8AD2F2

    2018

  48. [48]

    Star3Dlong, 2018, https://etherscan.io/address/ 0x3e22bB2279d6Bea3Cfe57f3Ed608fC3B1DeaDADf

    2018

  49. [49]

    A. C. S. to Bugs in Fomo3D-like Games, 2018, https://medium.com/coinmonks/how-the-winner-got-fomo3d-prize- a-detailed-explanation-b30a69b7813f

    2018

  50. [50]

    LastWinner, 2018, https://etherscan.io/address/ 0xDd9fd6b6F8f7ea932997992bbE67EabB3e316f3C

    2018

  51. [51]

    winner attacked event, 2018, https://anchainai.medium.com/ largest-smart-contract-attacks-in-blockchain-history-exposed-part-1-93b975a374d0

    L. winner attacked event, 2018, https://anchainai.medium.com/ largest-smart-contract-attacks-in-blockchain-history-exposed-part-1-93b975a374d0

    2018

  52. [52]

    Beautychain, 2018, https://etherscan.io/token/ 0xc5d105e63711398af9bbff092d4b6769c82f793d/

    2018

  53. [53]

    Blockchain use cases for inclusive fintech: Scalability, privacy, and trust distribution,

    D. K. C. Lee and C. S. L. Lim, “Blockchain use cases for inclusive fintech: Scalability, privacy, and trust distribution,”The Journal of FinTech, vol. 1, no. 01, p. 2050003, 2021

    2021

  54. [54]

    Finance, 2018, https://www.unreal.finance/

    U. Finance, 2018, https://www.unreal.finance/

    2018

  55. [55]

    Token, 2018, https://www.spacefalcon.io/

    F. Token, 2018, https://www.spacefalcon.io/

    2018

  56. [56]

    Bayesian optimization with inequality constraints

    J. R. Gardner, M. J. Kusner, Z. E. Xu, K. Q. Weinberger, and J. P. Cunningham, “Bayesian optimization with inequality constraints.” in ICML, vol. 2014, 2014, pp. 937–945

    2014

  57. [57]

    Semantic- enriched code knowledge graph to reveal unknowns in smart contract code reuse,

    Q. Huang, D. Liao, Z. Xing, Z. Zuo, C. Wang, and X. Xia, “Semantic- enriched code knowledge graph to reveal unknowns in smart contract code reuse,”ACM Transactions on Software Engineering and Method- ology, vol. 32, no. 6, pp. 1–37, 2023

    2023

  58. [58]

    Stack overflow,

    “Stack overflow,” 2008 Accesssed: 2020-9-08, https://stackoverflow. com/. Zhenguang Liuis currently a professor of Zhe- jiang University. He had been a research fellow in National University of Singapore and A*STAR. (Agency for Science, Technology and Research, Sin- gapore). He respectively received his Ph.D. and B.E. degrees from Zhejiang University and ...

    2008