一句话：对五种重入检测工具开展大规模实证评估，发现超过99.8%的报警为误报，指出现有能力有限。
本文对 Mythril、Sailfish 等五种重入检测工具进行大规模实证评估。作者从 Etherscan 收集 230,548 个已验证合约，去重后分析 139,424 个，其中 21,212 个被报存在重入问题。人工检查后仅确认 34 个真阳性合约，发现 21,178 个假阳性，并归纳原因。结果显示，工具报出的重入合约中超过 99.8% 为误报，可归为八类原因；工具主要只能检测 call.value() 导致的重入，其中 58.8% 可由 Remix 揭示。对过去两年真实攻击合约，工具均未发现问题。作者指出，现有重入检测能力有限，应转向发现和检测 call.value() 之外的新重入模式。
Smart contracts are programs deployed on a blockchain and are immutable once deployed. Reentrancy, one of the most important vulnerabilities in smart contracts, has caused millions of dollars in financial loss. Many reentrancy detection approaches have been proposed. It is necessary to investigate the performance of these approaches to provide useful guidelines for their application. In this work, we conduct a large-scale empirical study on the capability of five well-known or recent reentrancy detection tools such as Mythril and Sailfish. We collect 230,548 verified smart contracts from Etherscan and use detection tools to analyze 139,424 contracts after deduplication, which results in 21,212 contracts with reentrancy issues. Then, we manually examine the defective functions located by the tools in the contracts. From the examination results, we obtain 34 true positive contracts with reentrancy and 21,178 false positive contracts without reentrancy. We also analyze the causes of the true and false positives. Finally, we evaluate the tools based on the two kinds of contracts. The results show that more than 99.8% of the reentrant contracts detected by the tools are false positives with eight types of causes, and the tools can only detect the reentrancy issues caused by call.value(), 58.8% of which can be revealed by the Ethereum's official IDE, Remix. Furthermore, we collect real-world reentrancy attacks reported in the past two years and find that the tools fail to find any issues in the corresponding contracts. Based on the findings, existing works on reentrancy detection appear to have very limited capability, and researchers should turn the rudder to discover and detect new reentrancy patterns except those related to call.value().
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{ZhengZSZYC23,
title = {Turn the Rudder: A Beacon of Reentrancy Detection for Smart Contracts on Ethereum},
author = {Zibin Zheng and Neng Zhang and Jianzhong Su and Zhijie Zhong and Mingxi Ye and Jiachi Chen},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00036}
}