UEChecker: Deep Learning Vulnerability Detector

• UEChecker is a deep learning–based framework that models Solidity code as call graphs to identify unchecked external call vulnerabilities in DApps.
• It combines a GCN backbone with specialized modules—edge prediction, node aggregation, and a Conformer Block—to capture multi-scale code dependencies and improve detection accuracy (87.59%).
• UEChecker outperforms traditional static and symbolic tools by effectively formalizing cross-contract interactions and mitigating unchecked call risks leading to exploits like flash loan and reentrancy attacks.

UEChecker is a deep learning–based vulnerability detection framework for identifying unchecked external call vulnerabilities in decentralized applications (DApps). It operates on Solidity source code by constructing a call graph and applying a Graph Convolutional Network augmented with an edge prediction module, a node aggregation module, and a Conformer Block module. The tool targets a class of contract-layer defects in which contracts interact with external protocols without verifying the results of the calls, a pattern associated with exploit entry points such as flash loan attacks and reentrancy attacks. By auditing the smart contracts of 608 DApps, UEChecker reports an accuracy of 87.59% in detecting unchecked external call vulnerabilities (Kong et al., 2 Aug 2025).

1. Vulnerability model and problem setting

Unchecked external call vulnerabilities arise when a smart contract calls an external contract or function but fails to verify the return value or outcome of that call. In Solidity, many external calls return a boolean to indicate success or failure, yet developers sometimes ignore that return value and implicitly assume that the call succeeds. In DApps, this is dangerous because the application is composed of multiple interacting contracts, and silent failure of an external call can cause internal accounting and external reality to diverge (Kong et al., 2 Aug 2025).

The paper situates this vulnerability in the broader context of contract-layer attacks, stating that attacks at the DApp contract layer have caused economic losses of about $66 billion. It further associates unchecked external calls with exploit entry points such as flash loan attacks and reentrancy attacks. The stated motivation is not merely low-level error handling, but the correctness of cross-contract state transitions in systems such as DEXs, lending protocols, pools, and token contracts.

A representative example is the RewardPool contract, where the following call is executed without checking the return value:

$E \subseteq V \times V$7

The paper explains that if the token contract implements transfer with a non-reverting failure mode, the RewardPool will assume the reward was paid, zero out rewards[msg.sender] earlier in Reward(), and leave the user unpaid while the internal state says payment was completed. This is presented as a logical vulnerability rather than a crash-oriented bug. The authors report that Oyente, Confuzzius, and Conkas all failed to detect the vulnerability in this contract, because Oyente does not reason about the semantics of return values from external calls, Confuzzius does not model unchecked return values as a bug, and Conkas focuses mainly on concurrency issues (Kong et al., 2 Aug 2025).

A second motivating example is a flash loan exploit motif discussed through UniswapV2Pair::swap, where the paper characterizes the vulnerability conceptually as inadequate verification of the result of a critical external operation such as getReserves. This framing emphasizes that unchecked-call defects can be embedded in larger call-chain logic and transient cross-contract state dependencies.

2. Representation of DApps as call graphs

UEChecker treats DApp source code as a graph. The source is parsed with Surya, which produces a call graph in DOT format. The extraction pipeline consists of lexical analysis, syntactic analysis, call relationship extraction, and graph generation. Contract declarations, function declarations, function bodies, and call sites are identified; each function becomes a node, and each call becomes a directed edge from caller to callee (Kong et al., 2 Aug 2025).

Formally, the call graph is written as

$G = (V, E)$

where $V$ is the set of nodes and $E \subseteq V \times V$ is the set of edges. Nodes represent functions within or across contracts. Edges represent function calls, including internal calls, external calls, and library calls. The resulting graph is global at the DApp level rather than restricted to a single contract, which is important because the target vulnerability is tied to cross-contract interactions.

UEChecker builds three graph-level data structures from the DOT representation. First, it constructs a node feature matrix $X \in \mathbb{R}^{|V| \times C}$. Node labels such as function names and contract names are converted to indices and then mapped through an embedding matrix into vectors in $\mathbb{R}^C$. Second, it constructs an adjacency matrix $A \in \{0,1\}^{|V| \times |V|}$, where $A_{ij}=1$ if there is a directed edge from node $i$ to node $j$. Third, it builds an adjacency dictionary for neighborhood lookup and graph normalization (Kong et al., 2 Aug 2025).

The paper describes node labels as carrying semantic information such as function names, contract names, and semantic tags including transfer, approval, and withdrawal. Edge attributes encode call type and, where derivable from the code, whether there is an associated check on the return value. This graph-centric representation is the basis for all subsequent learning modules.

3. Architectural design

UEChecker combines a GCN backbone with three specialized modules: an edge prediction module, a node aggregation or clustering module, and a Conformer Block. The high-level workflow has two phases: source code is converted into a call graph with features, and the graph is then processed by the learning architecture to predict whether a DApp or contract contains unchecked external call vulnerabilities (Kong et al., 2 Aug 2025).

The edge prediction module reconstructs or refines the graph’s edge structure based on node features. Given node features $x_i$ and $V$0, the model computes

$V$1

where $V$2 consists of a linear layer plus batch normalization. The paper states that the predicted edge weights are then integrated into a new adjacency matrix, symmetrized as $V$3. This module is intended both to refine adjacency when static extraction is incomplete and to learn soft structural relations relevant to unchecked external calls.

The node aggregation module performs clustering over node representations. For node feature $V$4 and cluster center $V$5, the distance is defined as

$V$6

and the assignment is

$V$7

The paper presents this as a way to group structurally similar nodes, such as sets of functions participating in token transfer flows or external call sites sharing similar check patterns. This suggests a higher-level structural abstraction over the raw call graph, although the article’s empirical discussion remains focused on measured performance rather than formal interpretability claims.

The Conformer Block integrates feedforward layers, multi-head self-attention, and convolution. Its attention mechanism is given by

$V$8

The paper states that this module is intended to capture dependencies of different scales within the call graph, extending beyond immediate neighbors. In the DApp setting, that means combining local structural regularities with long-range interactions among distant call sites, including cross-contract patterns of checking or failing to check return values (Kong et al., 2 Aug 2025).

4. GCN backbone, training objective, and implementation

The GCN serves as the backbone for node-level graph embedding. The update rule is presented in standard form as

$V$9

with a normalized variant also discussed:

$E \subseteq V \times V$0

Here, $E \subseteq V \times V$1, $E \subseteq V \times V$2 is the normalized adjacency matrix built from refined edges, and $E \subseteq V \times V$3 is ReLU. In the pipeline summarized as Algorithm 1 in the paper, the model forms features from DOT graphs, predicts edges, builds an adjacency matrix, applies GCN, performs dropout and clustering, applies another GCN to cluster-level representations, masks padded nodes, passes the result through the Conformer Block, and finally applies dropout, max pooling, and a fully connected layer (Kong et al., 2 Aug 2025).

The task is binary classification: vulnerable versus non-vulnerable. The main classification objective is Cross-Entropy Loss,

$E \subseteq V \times V$4

The paper also evaluates BCEWithLogitsLoss and reports that CrossEntropyLoss performs better. BCEWithLogitsLoss yields F1-score 72.84%, Precision 63.75%, and Recall 90.30%, whereas CrossEntropyLoss yields F1-score 87.12%, Precision 90.30%, and Recall 86.53%. The preferred loss therefore reflects a better precision–recall trade-off rather than maximal recall alone (Kong et al., 2 Aug 2025).

The implementation uses Python 3.9 and PyTorch 2.1.1 on Ubuntu 22.04, with NVIDIA GeForce RTX 4070 Ti GPU, Intel i9-13900KF CPU, and 128 GB RAM. Training uses 600 epochs, AdamW, batch size 30, and a learning-rate search over $E \subseteq V \times V$5, with 0.00025 reported as best. The hidden layer size is searched over $E \subseteq V \times V$6, with 256 reported as best. Additional hyperparameters include edge hidden dimension 32, dropout 0.2, 8 attention heads, and head dimension 64 (Kong et al., 2 Aug 2025).

5. Datasets, baselines, and empirical results

The main evaluation uses DAppSCAN, which contains 608 DApp projects across categories such as DeFi and games, totaling 21,414 smart contracts. The paper states that audit reports are used to identify unchecked external call vulnerabilities, and that 3,833 core-business contracts are identified as vulnerability-free. A second dataset from Liu et al. contains 1,199 smart contracts labeled as having unchecked external call vulnerabilities and is used to validate generalization beyond DAppSCAN (Kong et al., 2 Aug 2025).

The principal reported result is that UEChecker achieves Accuracy 87.59%, Recall 86.53%, Precision 90.30%, and F1-score 87.12%. These values are presented as the overall performance of the full system.

A comparison with neural baselines is central to the paper’s empirical argument.

Model	Accuracy	F1-score
LSTM	60.30%	72.97%
GAT	48.82%	36.60%
GCN	52.93%	57.51%
UEChecker	87.59%	87.12%

The detailed baseline numbers also include Recall and Precision. LSTM reports Recall 77.48% and Precision 59.97%. GAT reports Recall 42.59% and Precision 43.35%. Plain GCN reports Recall 72.74% and Precision 49.86%. UEChecker reports Recall 86.53% and Precision 90.30%. The paper interprets these comparisons as evidence that sequence-based modeling loses graph structure, while simple graph models lack the ability to capture the relevant multi-hop and multi-scale patterns (Kong et al., 2 Aug 2025).

The ablation study decomposes the contribution of the three specialized modules. GCN alone yields Accuracy 52.93% and F1 57.51%. Edge Prediction + GCN yields Accuracy 78.80% and F1 82.15%. Edge Prediction + Cluster + GCN yields Accuracy 78.04% and F1 76.08%. The full UEChecker model, Edge Prediction + Cluster + GCN + Conformer, yields Accuracy 87.59% and F1 87.12%. The paper therefore identifies edge prediction as a major source of improvement and the Conformer Block as the final component enabling the best overall performance.

The paper also reports comparison with traditional tools. Oyente yields Accuracy 52.53%, Recall 50.15%, Precision 90.27%, and F1 64.58%. Mythril yields Accuracy 34.89%, Recall 47.34%, Precision 50.26%, and F1 48.75%. “Security” yields Accuracy 74.10%, Recall 53.90%, Precision 86.74%, and F1 68.72%. Confuzzius yields Accuracy 53.43%, Recall 53.44%, Precision 66.03%, and F1 59.07%. UEChecker exceeds these tools on all four reported metrics (Kong et al., 2 Aug 2025).

6. Position within the tool landscape, limitations, and future directions

UEChecker is positioned against several families of smart-contract analysis methods. Static analysis tools such as Slither, AChecker, and Securify are described as rule-based and limited in their ability to capture subtle inter-contract logic. Symbolic-execution systems such as Oyente, SmartEst, and Mythril are described as effective for path-based properties but weaker on logical misuses of return values that do not manifest as explicit failing paths. Fuzzers such as Confuzzius are described as unable to exhaustively explore DApp interaction spaces and as not inherently understanding that ignoring a call’s return value is a bug. Sequence-based deep learning systems such as SaferSC and DeeSCVHunter are described as losing the graph structure of multi-contract DApps. UEChecker’s distinction, according to the paper, is its use of call graphs, learnable edge refinement, clustering, and a Conformer Block for multi-scale dependency modeling (Kong et al., 2 Aug 2025).

The paper nevertheless states several limitations. UEChecker requires source code and does not directly operate on bytecode. It targets unchecked external call vulnerabilities specifically, so extending to other vulnerability classes would require re-training or expanded labeling. It also depends on the quality of Surya’s call graph extraction, although the edge prediction module is presented as a partial mitigation for missing or noisy edges. The authors describe the tool as supporting auditors rather than replacing manual review.

Future directions identified in the paper include extending the approach to other vulnerability types such as reentrancy and access control bugs, adapting graph extraction to bytecode for closed-source contracts, integrating the tool into larger auditing pipelines, optimizing inference for large-scale auditing, and combining the model’s structural analysis with LLMs for richer explanations and interactive auditing. A plausible implication is that the architecture is intended less as a single-purpose detector than as a template for graph-based DApp security analysis, but the paper’s validated claims remain confined to unchecked external call vulnerabilities and the reported datasets.