M. di Angelo, Gernot Salzer: Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations. DOI: 10.48550/arXiv.2609.01186

---

CVE Smart Contracts

This repository hosts a dataset of smart contracts associated with vulnerability claims in the Common Vulnerabilities and Exposures (CVE) database as of 2026-07-24. Alongside the original CVE records, the dataset contains source artifacts, deployed bytecode, labels from three vulnerability taxonomies (CWE, SWC, and Iuliano-DiNucci-2026), and function-level locations of the vulnerabilities. The dataset does not independently verify the vulnerability claims.

The dataset emphasizes validating the correspondence among a CVE vulnerability claim, its source artifact, and its deployment. To this end, it collects and archives evidence from external websites and the blockchain. A correspondence is considered validated—that is, the artifacts are considered to match the CVE record—if a sufficient number of indicators coincide, such as addresses, contract, function, or token names, and code snippets.

Another aim is reproducibility. The three stages of analysis (correspondence validation, vulnerability labeling, and vulnerability localization) are scripted and require minimal user input. The scripts generate automatic candidates; ambiguous, insufficiently supported, or otherwise unresolved cases require manual review.

Where to start

• cve.json contains all non-refuted CVE claims concerning deployed contracts for which matching artifacts are available, together with vulnerability labels and source locations.

• data/index.csv is the complete curated index of all CVE records and their associated artifacts.

• metadata.json lists the dataset version, CVE snapshot date, coverage counts, selection rules, taxonomy sources, and schema locations.

Dataset statistics

The dataset distinguishes two types of artifacts. Contracts are identified by a deployment address, while projects (mostly libraries) are maintained in conventional repositories. For details of this distinction see data/index.md.

CVE records	contracts	projects
total (index.csv)	542	26
with vulnerability labels	542	26
with matching artifacts	497	26
with refuted vulnerability claim	8	0
non-refuted, with matching artifact	491	26
with function-level location	491	—

Of the 542 contracts, 541 have been deployed on Ethereum and one on BNB Smart Chain.

Although the dataset does not systematically validate the vulnerability claims, it identifies eight claims as refuted and excludes them from cve.json. In such cases, the associated code may contain the claimed vulnerable fragment only in an inactive form (for example, commented out), or an alleged overflow can be shown not to be realizable.

Related datasets

This dataset extends work by the Software Analysis Laboratory at Korea University:

• VeriSmart-benchmarks contains 487 CVE-reported Solidity contracts assembled for the VeriSmart and SmarTest experiments. Its metadata identifies the 60 contracts used in the VeriSmart S&P 2020 paper, a deduplicated set of 443 contracts used in the SmarTest USENIX Security 2021 paper, and a sampled set of 300 contracts.

• SmartFix-Artifact CVE benchmark is a repair-oriented subset of the VeriSmart corpus used in the SmartFix ESEC/FSE 2023 evaluation.

The present dataset is a superset of these two benchmarks. It also provides validated CVE–artifact correspondences, vulnerability labels, and function-level vulnerability locations.

Main data and folders

• data/ contains the curated file index.csv, CVE records, source artifacts identified as affected in those records, compilation metadata, deployed runtime bytecode, and scripts for downloading and checking the curated data.

• validation/ archives supporting evidence, including external documents referenced by CVE records, additional sources downloaded manually, code snippets extracted from screenshots in documents using OCR, and the results of querying view functions on the blockchain. Based on this evidence, the scripts in this folder assess the correspondence between CVE claims and artifacts, with the results written to validation/validation.csv.

• labeling/ houses the rules and manual decisions for assigning labels according to three taxonomies, with the results in labeling/labels.json.

• localization/ contains scripts that determine the locations of vulnerabilities based on the compiler-generated AST, as well as manual decisions for ambiguous cases. The results are stored in localization/locations.json.

See REPRODUCIBILITY.md for component versions, the reference compiler inventory, build instructions, and release verification.

Machine-readable JSON schemas are listed in metadata.json. The frozen taxonomy versions and their upstream provenance are documented in labeling/taxonomies/README.md.