paperbot · PL 论文追踪

全部论文 待读 收藏

P2 BSHUNTER: Detecting and Tracing Defects of Bitcoin Scripts

BSHUNTER：比特币脚本缺陷的检测与追踪
ICSE 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE)2023匹配度 3/10 · 论文属于程序分析与安全领域，使用符号执行和虚拟机插桩检测比特币脚本缺陷，与用户偏好的工程实现有一定共通性；但它不涉及 LLM/Agent 改进静态分析，也不涉及浮点程序分析或贝叶斯程序分析，与研究画像的核心交叉方向缺乏直接关联。引用 7 inbox
Peilin Zheng, Xiapu Luo, Zibin Zheng
程序分析与抽象解释安全与隐私
crossref: 2026-09-12dblp: 2026-09-12

AI 速览

一句话：首次系统研究比特币脚本缺陷，定义六类缺陷，并用符号执行检测和虚拟机插桩追踪其利用。

本文首次系统研究比特币脚本缺陷，指出脚本缺陷会导致用户损失比特币。作者首先在比特币历史中定义六类典型缺陷：unbinded-txid、simple-key、useless-sig、uncertain-sig、impossible-key 和 never-true，其中三类来自社区，三类为新提出。其次，开发基于符号执行并以历史精确脚本增强的检测工具，扫描 2009 年 10 月至 2022 年 8 月的全部比特币交易，发现 383,544 个输出支付给缺陷脚本，金额合计 3,115.43 BTC（目前约 6000 万美元）。最后，插桩 Bitcoin VM 记录真实花费交易轨迹，发现 84,130 个输出脚本被利用。实现与无害数据集已发布。

问题
比特币脚本缺陷可能导致用户丢失比特币，但此前缺乏对缺陷定义、分布与利用情况的系统研究。
方法
作者定义六类典型脚本缺陷，并实现基于符号执行且用历史精确脚本增强的检测工具，再插桩 Bitcoin VM 以追踪缺陷脚本的真实花费轨迹。
评估
分析 2009 年 10 月至 2022 年 8 月全部比特币交易，发现 383,544 个缺陷输出（3,115.43 BTC），并追踪到 84,130 个被利用的输出脚本。
原文摘要（Abstract）

Supporting the most popular cryptocurrency, the Bitcoin platform allows its transactions to be programmable via its scripts. Defects in Bitcoin scripts will make users lose their bitcoins. However, there are few studies on the defects of Bitcoin scripts. In this paper, we conduct the first systematic investigation on the defects of Bitcoin scripts through three steps, including defect definition, defect detection, and exploitation tracing. First, we define six typical defects of scripts in Bitcoin history, namely unbinded-txid, simple-key, useless-sig, uncertain-sig, impossible-key, and never-true. Three are inspired by the community, and three are new from us. Second, we develop a tool to discover Bitcoin scripts with any of typical defects based on symbolic execution and enhanced by historical exact scripts. By analyzing all Bitcoin transactions from Oct. 2009 to Aug. 2022, we find that 383,544 transaction outputs are paid to the Bitcoin scripts with defects. The total amount of them is 3,115.43 BTC, which is around 60 million dollars at present. Third, in order to trace the exploitation of the defects, we instrument the Bitcoin VM to record the traces of the real-world spending transactions of the buggy scripts. We find that 84,130 output scripts are exploited. The implementation and non-harmful datasets are released.

链接与引用

DOI 原文 · DBLP

BibTeX 
@inproceedings{ZhengLZ23,
  title = {BSHUNTER: Detecting and Tracing Defects of Bitcoin Scripts},
  author = {Peilin Zheng and Xiapu Luo and Zibin Zheng},
  booktitle = {ICSE},
  year = {2023},
  doi = {10.1109/icse48619.2023.00037}
}