// the take
A research dataset from an ICSE'23 paper that catalogs exploitable smart contract bugs pulled from code4rena audit contests, classified by whether they're catchable with generic oracles (like reentrancy checkers) or need bespoke semantic logic. It's aimed at smart contract security researchers and auditors building or evaluating vulnerability detection tools, not at developers looking for a library to install.
The bugs are grounded in real audit findings with the actual contract code and code4rena reports included, so you can cross-reference a labeled bug against the exact vulnerable code rather than trusting a paraphrase. The core finding — that most exploitable bugs are 'functional' bugs invisible to generic detectors — is a genuinely useful corrective for anyone building a fuzzer or static analyzer around reentrancy/overflow checklists. The companion tool list (Slither, Foundry, Echidna, Halmos, etc.) is well-scoped to source-level techniques relevant to Solidity auditing rather than a generic security-tools dump.
This is a CSV-plus-folders dataset, not a tool or API — there's no query interface, so using it means writing your own tooling against bugs.csv and the per-contract directories. The bug classification is explicitly acknowledged by the authors as ambiguous and judgment-based, with no inter-rater agreement numbers, so treating the O/L/S labels as ground truth for benchmarking a detector is risky. Last push was mid-2025 and the README still says the dataset is a work in progress tied to ongoing contests, so coverage of anything audited since then is likely missing. It's a single academic team's output rather than a project with a defined maintenance commitment, so there's no guarantee of continued updates as code4rena contests pile up.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →