Using Spiking Neural Networks for Smart Contract Vulnerability Detection

Smart contract security is usually treated as a static analysis problem: pattern matching, rule-based scanners, symbolic execution, or, more recently, large language models operating on source code.

However, many real-world vulnerabilities in Solidity are not static patterns — they are dynamic execution scenarios that unfold over time.

In this article, I describe an experimental pipeline that applies Spiking Neural Networks (SNNs) to Solidity vulnerability detection, focusing on temporal reasoning, robustness, and leakage-aware evaluation. The results show that even a relatively simple SNN baseline can achieve strong generalization while remaining interpretable and robust.

Why Spiking Neural Networks?

Spiking Neural Networks differ fundamentally from classical neural models:

• information is encoded as events (spikes) in time,
• computation depends on when spikes occur, not just their magnitude.

Key properties that make SNNs attractive for security analysis:

• Temporal causality instead of pure correlation
• Sparse, event-driven computation
• Interpretability through spike dynamics and membrane potentials

Conceptually, SNNs are much closer to execution semantics than to text modeling.

Dataset Overview

Dataset Overview

The experiments use a real-world Solidity dataset with:

• 40,313 contracts
• Binary vulnerability label (binary_label)
• SWC-based vulnerability annotations
• Rich engineered features:
• Solidity keyword counts (kw_*)
• Dangerous operation counters (count_call_value, count_safe_transfer, etc.)
• Code size statistics (n_chars, n_lines)
• Explicit duplicate detection via is_code_duplicate_group

The last point is crucial.

SNN Architecture

The model consists of:

• two spiking layers (Leaky Integrate-and-Fire neurons),
• dropout for regularization,
• an analog readout head that aggregates membrane activity over time.

Instead of summing output spikes, the model aggregates membrane potentials, which leads to more stable gradients and better convergence.

Results

Unique Test Set (Generalization)

• ROC AUC ≈ 0.89
• Clear separation between vulnerable and non-vulnerable contracts
• Balanced confusion matrix with controlled false positives

The probability histograms show strong class separation, indicating that the model learns a meaningful risk signal rather than memorizing artifacts.

Duplicate Stress Test (Robustness)

• ROC AUC ≈ 0.91
• Stable performance despite heavy code duplication
• No collapse into trivial memorization

This is particularly important as many models perform well only because of duplication, not despite it.

Learning Dynamics

Training curves show:

• smooth loss convergence,
• stable validation F1,
• steadily increasing validation AUC.

This suggests that the SNN is learning a consistent temporal representation rather than oscillating between shortcuts.

This work is intentionally a baseline. Obvious next steps include:

• event-based encoding from CFG / DFG traces,
• multi-label classification over SWC categories,
• hybrid SNN + Transformer readouts,
• integrating execution-level events instead of tabular features.

Why This Matters

This experiment demonstrates several important points:

1. Smart contract vulnerabilities are temporal phenomena
2. SNNs provide a natural inductive bias for such problems
3. Leakage-aware evaluation is essential in Web3 security datasets

Even a simple SNN baseline can be:

• robust,
• interpretable,
• competitive with much heavier models

Spiking Neural Networks are often discussed in the context of neuromorphic hardware or biological plausibility. This work shows that they are also a practical modeling tool for security problems where time, order, and causality matter. Smart contracts execute in time. This model should reflect that.