Go to file
Tuan-Dat Tran 841b2aafec Adjust README.md
Signed-off-by: Tuan-Dat Tran <tuan-dat.tran@tudattr.dev>
2024-04-05 10:34:48 +02:00
dataset For ethfuzz 2024-04-05 10:31:37 +02:00
LICENSE Initial commit 2022-11-21 21:40:38 +00:00
README.md Adjust README.md 2024-04-05 10:34:48 +02:00


SB Curated: A Curated Dataset of Vulnerable Solidity Smart Contracts

SB Curated is a dataset for research in automated reasoning and testing of smart contracts written in Solidity, the primary language used in Ethereum. It was developed as part of the execution framework SmartBugs, which allows the possibility to integrate tools easily, so that they can be automatically compared (and their results reproduced). To the best of our knowledge, SmartBugs Curated is the largest dataset of its kind.


SmartBugs Curated provides a collection of vulnerable Solidity smart contracts organized according to the DASP taxonomy:

Vulnerability Description Level
Reentrancy Reentrant function calls make a contract to behave in an unexpected way Solidity
Access Control Failure to use function modifiers or use of tx.origin Solidity
Arithmetic Integer over/underflows Solidity
Unchecked Low Level Calls call(), callcode(), delegatecall() or send() fails and it is not checked Solidity
Denial Of Service The contract is overwhelmed with time-consuming computations Solidity


Contracts are annotated with a comment containing information about their source (@source), author (@author), and line numbers of where vulnerabilities are reported (@vulnerable_at_lines). For each identified line, a comment with the type of the vulnerability is added (// <yes> <report> CATEGORY). Here is the example of time_manipulation/timed_crowdsale.sol, which identifies a vulnerability of type TIME_MANIPULATION in line 19:

 * @source: https://github.com/SmartContractSecurity/SWC-registry/blob/master/test_cases/timestamp_dependence/timed_crowdsale.sol
 * @author: -
 * @vulnerable_at_lines: 13

pragma solidity ^0.4.25;

contract TimedCrowdsale {
  // Sale should finish exactly at January 1, 2019
  function isSaleFinished() view public returns (bool) {
    // <yes> <report> TIME_MANIPULATION
    return block.timestamp >= 1546300800;

Adding New Contracts

We welcome the community to add new contracts or update existing annotations. Please create a new pull request with the new information, following the annotation style described above. Moreover, please update the vulnerabilities.json file at the root of the repository. You can update this file by running the script scripts/get_vulns_lines.js. We suggest that you format the JSON file by running python -m json.tool.

Work that uses SmartBugs Curated


All the contracts were obtained from public websites or using Etherscan and they retain their original licenses. For all the other files, the license detailed in the file LICENSE applies.