README.md

Dataset inputs

For most dataset use, begin with the curated file index.csv and its column specification. The other files are the source and deployment artifacts referenced by index rows. The contents of this folder, together with the evidence under validation/, form the inputs to the validation, labeling, and localization pipelines.

Important files

• cves/CVE-*.json contains one retained CVE v5 record per indexed CVE.
• contract_sources/ contains affected artifacts for kind=contract rows.
• library_sources/ contains affected projects for kind=library rows.
• etherscan/<chain>-<src_addr>.json contains retained verified-source responses.
• runtime/<chain>-<addr>.hex contains retained deployed runtime bytecode.
• scripts/ contains the acquisition and consistency utilities above.

Acquisition and checking pipeline

The following maintainer workflow explains how the retained inputs were assembled or can be extended:

1. Filter Ethereum smart-contract records from a CVE v5 checkout:

   python data/scripts/filter_ethereum_smart_contract_cves.py /path/to/cvelistV5

2. Curate index.csv and add deployment addresses and affected library projects where applicable.

3. Fetch contract artifacts for the addresses referenced by contract rows:

   export ETHERSCAN_API_KEY=...
   python data/scripts/fetch_etherscan_artifacts.py 0x...
   python data/scripts/fetch_etherscan_artifacts.py --chain bsc 0x...

   The fetcher independently attempts to retain the explorer response, unpacked source, runtime bytecode, and token name()/symbol() call results.

4. Check the retained files and index relationships:

   python data/scripts/check_data_integrity.py

check_runtime_sources.py is an optional diagnostic that recompiles verified source and compares its runtime and selectors with retained deployments. The validation pipeline performs the maintained claim checks used in its outputs.