DIVE: A Multi-Label Smart Contract Vulnerability Dataset

Area of Science:

• Computer Science
• Software Engineering
• Cybersecurity

Background:

• Smart Contract (SC) vulnerabilities pose significant risks, leading to financial losses and functional failures.
• Existing datasets for SC vulnerability detection are often limited by size, imbalance, inconsistent labeling, and non-standardized features, hindering reliable machine learning (ML) model development.
• Current feature representations often neglect different contract lifecycle stages, impacting model generalization and benchmark accuracy.

Purpose of the Study:

• To introduce DIVE, a novel multi-label dataset designed to overcome the limitations of existing SC vulnerability datasets.
• To provide a comprehensive resource for training and evaluating ML models for SC vulnerability detection.
• To enable more reliable and generalizable vulnerability detection across different stages of the smart contract lifecycle.

Main Methods:

• DIVE comprises 22,330 real-world SCs deployed between 2016 and 2024, covering major Solidity compiler versions.
• SCs are annotated for eight vulnerability types based on the Decentralized Application Security Project (DASP) Top 10 taxonomy.
• A standardized multi-tool labeling pipeline utilizing Power-based voting and post-hoc filtering was employed, correcting significant false positives in Denial of Service (DoS) and Time Manipulation vulnerabilities.

Main Results:

• The DIVE dataset provides 221 pre-deployment and 176 post-deployment features, offering lifecycle-specific feature sets.
• The labeling pipeline successfully corrected 14.3% of false positives in DoS and 24.9% in Time Manipulation vulnerabilities.
• The dataset supports reproducible benchmarking through an open-source framework, facilitating periodic reconstruction aligned with evolving vulnerability patterns.

Conclusions:

• DIVE addresses critical structural and feature-level limitations in existing SC vulnerability datasets.
• The dataset's comprehensive nature and lifecycle-specific features enhance the reliability and generalizability of ML-based SC vulnerability detection.
• DIVE promotes reproducible research and adaptable vulnerability detection methodologies in the evolving landscape of smart contract security.