Bridging Source Code and Bytecode for Smart Contract Vulnerability Detection via Dual-Perspective Cross-Modal Distillation
About
Smart contract vulnerabilities have caused substantial financial losses, yet most deployed contracts are closed-source, forcing detection to operate on bytecode --- which lacks the high-level semantic information available in source code. To compensate, recent cross-modal methods distill knowledge from source-code models into bytecode detectors by aligning the two modalities. However, these methods align source and bytecode only at the graph level through global embedding matching, whereas vulnerability is a property of specific nodes and control-flow regions --- so the student preserves global structure but loses the fine-grained node-level correspondences that decide a contract's safety. We propose ExDoS, a dual-focus cross-modal distillation framework that addresses this limitation from three angles. First, We introduce aligned vulnerability patterns that mark corresponding nodes in both source and bytecode graphs, establishing the missing node-level supervision and cross-modal correspondence; with these correspondences in place, we then propose a dual-attention graph network that applies relation-aware attention and adaptive node weighting so that vulnerable nodes survive into the graph-level embedding rather than being diluted by uniform aggregation; given preserved node-level signals and established correspondences, we also propose a dual-focus distillation objective whose global loss retains whole-graph alignment while its local loss matches expert-paired nodes to enforce region-level consistency. On real-world contracts, ExDoS reaches F1 of 90.86%, 90.23%, and 83.94% for reentrancy, timestamp dependency, and infinite loop --- improving by 2.7--5.1 points over the strongest per-type baseline. Our ablations confirm that the pattern annotations, local alignment, and attentive encoding each address a distinct limitation of prior distillation-based approaches.