ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment

Tran Duong Minh Dai; Triet Huynh Minh Le; M. Ali Babar; Van-Hau Pham; Phan The Duy

cs.LGMar 30, 2026

ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment

Authors: Tran Duong Minh Dai, Triet Huynh Minh Le, M. Ali Babar, Van-Hau Pham, Phan The Duy

Organizations: Information Security Lab, University of Information Technology, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam · School of Computer Science and Information Technology, Adelaide University, Adelaide, Australia

Abstract

Although Graph Neural Networks (GNNs) have shown promise for smart contract vulnerability detection, they still face significant limitations. Homogeneous graph models fail to capture the interplay between control flow and data dependencies, while heterogeneous graph approaches often lack deep semantic understanding, leaving them susceptible to adversarial attacks. Moreover, most black-box models fail to provide explainable evidence, hindering trust in professional audits. To address these challenges, we propose ORACAL (Observable RAG-enhanced Analysis with CausAL reasoning), a heterogeneous multimodal graph learning framework that integrates Control Flow Graph (CFG), Data Flow Graph (DFG), and Call Graph (CG). ORACAL selectively enriches critical subgraphs with expert-level security context from Retrieval-Augmented Generation (RAG) and Large Language Models (LLMs), and employs a causal attention mechanism to disentangle true vulnerability indicators from spurious correlations. For transparency, the framework adopts PGExplainer to generate subgraph-level explanations identifying vulnerability triggering paths. Experiments on large-scale datasets demonstrate that ORACAL achieves state-of-the-art performance, outperforming MANDO-HGT, MTVHunter, GNN-SC, and SCVHunter by up to 39.6 percentage points, with a peak Macro F1 of 91.28% on the primary benchmark. ORACAL maintains strong generalization on out-of-distribution datasets with 91.8% on CGT Weakness and 77.1% on DAppScan. In explainability evaluation, PGExplainer achieves 32.51% Mean Intersection over Union (MIoU) against manually annotated vulnerability triggering paths. Under adversarial attacks, ORACAL limits performance degradation to approximately 2.35% F1 decrease with an Attack Success Rate (ASR) of only 3%, surpassing SCVHunter and MANDO-HGT which exhibit ASRs ranging from 10.91% to 18.73%.

Figures & tables

Method	Year	Category	Technique	Semantic	Explainability
Oyente [ 27 ]	2016	Static Analysis	Symbolic Execution	No	Yes
Slither [ 28 ]	2018	Static Analysis	Rule-based	No	Yes
Peculiar [ 29 ]	2019	Deep Learning	Homogeneous Graph	No	No
GNN-SC [ 30 ]	2021	Deep Learning	Homogeneous Graph	No	No
MANDO-HGT [ 31 ]	2023	Deep Learning	Heterogeneous Graph	No	No
SCVHunter [ 11 ]	2024	Deep Learning	Heterogeneous Graph	No	No

Table 1: Comparison of Our Work with Related Smart Contract Vulnerability Detection Methods

Figure 1: Overview of the ORACAL Framework. The pipeline proceeds from heterogeneous graph construction to identifying critical nodes, enriching them via RAG, and finally training a causal attention-based GNN.

Figure 2: Comparison between (a) a standard heterogeneous graph and (b) our enriched heterogeneous graph.

Panel of Figure 3 — Figure 3: RAG Prompt Structure: Injecting Knowledge Context.

Panel of Figure 4 — Figure 4: RAG Prompt Structure: Subgraph Representation.

Panel of Figure 5 — Figure 5: RAG Prompt Structure: Reasoning Steps and JSON Schema.

Panel of Figure 6 — Figure 6: Examples of RAG-enriched outputs: (a) node-level enrichment and (b) edge-level enrichment.

Figure 7: Detailed Architecture of the Causal Attention HeteroClassifier. The input is split into Causal ( $h_{enrich}$ ) and Spurious ( $h_{orig}$ ) branches, processed by dual encoders, fused via attention, and refined by GNN layers before final classification.

Vulnerability Type	SoliAudit		CGT Weakness		DAppScan		LLMAV
Vulnerability Type	Pos.	Neg.	Pos.	Neg.	Pos.	Neg.	Pos.	Neg.
Arithmetic	9,849	806	530	815	20	104	472	557
Low-Level Calls	3,109	7,546	801	544	3	121	68	961
Denial of Service	4,657	5,998	776	569	10	114	119	910
Time Manipulation	3,420	7,235	845	500	7	117	415	614
Total Samples	10,655		1,345		124		1,029

Table 2: Distribution of Vulnerabilities Across Datasets

Dataset	Vulnerability	Train	Test	Total
SoliAudit	Arithmetic	7,879	1,970	9,849
	Low Level Calls	2,487	622	3,109
	Denial of Services	3,726	931	4,657
	Time Manipulation	2,736	684	3,420
CGTWeakness	Arithmetic	424	106	530
	Low Level Calls	641	160	801

Table 3: Label-wise Distribution of Smart Contract Vulnerabilities in Training (SoliAudit + CGTWeakness) and Testing Sets. DAppScan and LLMAV are used exclusively as OOD test datasets and explainability benchmarks.

Parameter Type	Parameter	Value
Training	Epochs	50
	Learning Rate	2e-4
	Batch Size	64
	Optimizer	AdamW
	Weight Decay	0.0001
	Dropout Rate	0.2

Table 4: Hyperparameters for Model Training and RAG Enrichment

Figure 8: Average code-level metrics per contract across four datasets. Bars represent: LOC (teal), Invocation (blue), StateVars (coral), CFComplexity (orange), and ExtCalls (dark gray).

Figure 9: Average graph-scale statistics per contract across four datasets. Bars represent: Node count (teal), Edge count (blue), Node enrichment length in characters (coral), and Edge enrichment length in characters (tan).

Training Type	Scenario	Accuracy (%)	F1-Macro (%)	Precision (%)	Recall (%)
Standard	No enrichment (baseline)	82.84	86.94	90.36	84.05
	Only edge enrichment	82.85	87.19	89.94	84.79
	All node + edge enrichment	82.62	86.93	89.03	85.11
	All node enrichment	82.02	86.74	88.37	85.29
	Only enrichment text	72.63	72.21	79.38	67.92
	Only Operational Context	82.90	87.14	90.32	84.35

Table 5: Ablation Study Comparing Standard and Causal Training on the SoliAudit Test Set. Highlighted rows indicate the models with the highest F1score (lighter red for Standard and darker red for Causal).

Panel of Figure 10 — Figure 10: F1-Score heatmaps comparing Causal and Standard models on the SoliAudit test set.

Figure 11: Summary of structural bias across scenarios.

Panel of Figure 12 — Figure 12: Comparison of training and test losses across 50 epochs for both Causal and Standard training models on the SoliAudit test set.

Figure 13: Inference time comparison (ms/sample) across Causal and Standard models for various enrichment scenarios on the SoliAudit test set.

Dataset	Vulnerability Class	ORACAL-edge Causal	ORACAL-edge Standard	ORACAL-node-edge Causal	ORACAL-node-edge Standard
		(Mean $\pm$ Std Dev)	(Mean $\pm$ Std Dev)	(Mean $\pm$ Std Dev)	(Mean $\pm$ Std Dev)
CGT	Arithmetic	0.982 $\pm$ 0.004	0.967 $\pm$ 0.004	0.976 $\pm$ 0.005	0.959 $\pm$ 0.006
	LowLevelCalls	0.877 $\pm$ 0.015	0.836 $\pm$ 0.017	0.869 $\pm$ 0.017	0.827 $\pm$ 0.019
	DenialOfService	0.882 $\pm$ 0.013	0.844 $\pm$ 0.018	0.874 $\pm$ 0.015	0.835 $\pm$ 0.020
	TimeManipulation	0.921 $\pm$ 0.010	0.883 $\pm$ 0.019	0.912 $\pm$ 0.012	0.874 $\pm$ 0.021
	Overall (Macro F1)	0.918 $\pm$ 0.004	0.883 $\pm$ 0.006	0.908 $\pm$ 0.006	0.874 $\pm$ 0.008

Table 6: Generalization Performance on in-domain dataset (CGT) and OOD datasets (DAppScan, LLMAV) (Macro F1, Mean

\pm

Std Dev, 5 runs). ORACAL-edge: best SoliAudit F1 (all edge fields); ORACAL-node-edge: full feature set (all node + edge fields). Causal/Standard refer to training paradigms. Red-highlighted rows indicate the best-detected vulnerability class per dataset.

Dataset	Explainer	MSP(%)	MSR(%)	MIoU(%)
LLMAV [ 26 ]	GNNExplainer	35.86	39.72	27.96
	PGExplainer	40.91	44.85	32.51
	AttentionExplainer	27.94	31.62	19.17
DAppScan [ 25 ]	GNNExplainer	33.74	37.91	26.05
	PGExplainer	39.68	42.77	30.85
	AttentionExplainer	25.81	29.47	17.08

Table 7: Explanation quality comparison using VTP metrics. Bold values indicate the best-performing explainer for each dataset and metric.

Figure 14: Line-level explainer comparison for an Unchecked Low Level Calls vulnerability (contract 0xc5B2508...5BB349.sol ). Columns show binary importance scores (1=identified as important, 0=not) assigned by Ground Truth, GNNExplainer, PGExplainer, and AttentionExplainer. Red values indicate disagreement with the ground truth.

Figure 15: Illustration of textual adversarial perturbation via antonym substitution.

Figure 16: Structural adversarial perturbation involving edge addition and removal.

Panel of Figure 20 — Figure 20: ROC-AUC comparison across datasets.

Model	Method	SoliAudit		CGTWeakness		DAppScan
Model	Method	F1(%)	ASR(%)	F1(%)	ASR(%)	F1(%)	ASR(%)
GNN-SC	Original	70.74	-	70.20	-	66.47	-
GNN-SC	HSAttack	61.92(-8.82)	11.04	61.07(-9.13)	11.62	57.90(-8.57)	10.31
MTVHunter	Original	78.10	-	78.73	-	58.94	-
MTVHunter	HSAttack	69.65(-8.45)	10.91	69.82(-8.91)	11.47	51.92(-7.02)	9.73
SCVHunter	Original	51.62	-	50.20	-	28.44	-

Table 8: Evasion attack performance comparison. Values in parentheses indicate the relative F1 decrease vs. the Original setting. The light-red row indicates the method achieving the highest Original F1 score (ORACAL-node-edge Causal). The dark-red row indicates the attack scenario with the lowest F1 degradation and ASR (ORACAL-node-edge Causal under SubAttack). "–" denotes not applicable (original, pre-attack setting; ASR is undefined).

Software Vulnerability Detection

Software vulnerability detection identifies insecure code, pinpoints weaknesses, and helps developers validate or prevent exploitable bugs.

See all 139 papers

AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling
Jun 4, 2026Gabriela Dobrita, Simona-Vasilica Oprea, Adela BaraGraph Neural Networks Software Vulnerability Detection
Bucharest University of Economic Studies, Department of Economic Informatics and Cybernetics, no.6 Piața Romană, Bucharest, 010374, Romania
Robust Smart Contract Vulnerability Detection via Contrastive Learning-Enhanced Granular-ball Training
Mar 29, 2026Zeli Wang, Qingxuan Yang, Shuyin Xia +3Software Vulnerability Detection Learning with Noisy Labels
Chongqing Key Laboratory of Computational Intelligence, Key Laboratory of Cyberspace Big Data Intelligent Security, Ministry of Education, and Key Laboratory of Big Data Intelligent Computing, Chongqing University of Posts and Telecommunications. · the School of Cyber Science and Engineering, Huazhong University of Science and Technology. · School of Computer Science and Artificial Intelligence, Zhengzhou University, China. +1
Tailored Prompts, Targeted Protection: Vulnerability-Specific LLM Analysis for Smart Contracts
May 5, 2026Xing Zhang, Keyu Zhang, Taohong Zhu +1Software Vulnerability Detection LLMs for Cybersecurity
NetX Foundation Zug, Switzerland · Department of Computer Science University of Oxford Oxford, UK · Department of Computer Science The University of Manchester Manchester, UK

Jun 4, 2026J/K move · Enter open · S save

AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling

Gabriela Dobrita, Simona-Vasilica Oprea, Adela Bara

Bucharest University of Economic Studies, Department of Economic Informatics and Cybernetics, no.6 Piața Romană, Bucharest, 010374, Romania

Graph Neural Networks Software Vulnerability Detection

Open paper AskPDF arXiv

Existing learning-based detectors for Solidity smart-contracts reduce vulnerability detection to syntactic pattern matching within single functions, yet many of the most consequential exploits (The DAO, Cream Finance) exist not in any individual function but in the relationship between functions and in the combination of conditions that made the attack feasible. Thus, we propose AttackPathGNN, a graph neural network (GNN) that reframes detection as reasoning over explicit attack paths. Two architectural choices distinguish it from prior GNN-based detectors: (1)a State Interference Graph that links every pair of functions sharing mutable storage through typed, weighted edges and through directed reentrancy-path edges defined by an explicit five-condition predicate; (2)conjunction pooling, a differentiable AND-aggregator over eight named exploit preconditions whose log-sigmoid form causes the per-function exploit score to collapse whenever any single mitigation (a reentrancy guard, an access-control modifier or SafeMath) is in place. Across five independent training runs, AttackPathGNN attains 92.3+/-0.2% F1 on the SmartBugs Wild held-out test partition (4.3+/-0.3% false-negative rate, 90.8+/-2.5% detection rate on the independently human-labelled SmartBugs Curated benchmark), recovering 6/10 DASP10 categories at 100% on every seed and Reentrancy at 98.7+/-1.8%. Each prediction is emitted with a structured remediation report, turning each verdict into an actionable, function-level audit finding.

Abstract

Software Vulnerability Detection

Explore similar work

AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling

Robust Smart Contract Vulnerability Detection via Contrastive Learning-Enhanced Granular-ball Training

Tailored Prompts, Targeted Protection: Vulnerability-Specific LLM Analysis for Smart Contracts