  Learning heterogeneous graphs consisting of different types of nodes and
edges enhances the results of homogeneous graph techniques. An interesting
example of such graphs is control-flow graphs representing possible software
code execution flows. As such graphs represent more semantic information of
code, developing techniques and tools for such graphs can be highly beneficial
for detecting vulnerabilities in software for its reliability. However,
existing heterogeneous graph techniques are still insufficient in handling
complex graphs where the number of different types of nodes and edges is large
and variable. This paper concentrates on the Ethereum smart contracts as a
sample of software codes represented by heterogeneous contract graphs built
upon both control-flow graphs and call graphs containing different types of
nodes and links. We propose MANDO, a new heterogeneous graph representation to
learn such heterogeneous contract graphs' structures. MANDO extracts customized
metapaths, which compose relational connections between different types of
nodes and their neighbors. Moreover, it develops a multi-metapath heterogeneous
graph attention network to learn multi-level embeddings of different types of
nodes and their metapaths in the heterogeneous contract graphs, which can
capture the code semantics of smart contracts more accurately and facilitate
both fine-grained line-level and coarse-grained contract-level vulnerability
detection. Our extensive evaluation of large smart contract datasets shows that
MANDO improves the vulnerability detection results of other techniques at the
coarse-grained contract level. More importantly, it is the first learning-based
approach capable of identifying vulnerabilities at the fine-grained line-level,
and significantly improves the traditional code analysis-based vulnerability
detection approaches by 11.35% to 70.81% in terms of F1-score.
