一句话：提出 GPTScan，将 GPT 与程序分析结合以检测智能合约中的逻辑漏洞。
智能合约易受多种漏洞影响，造成重大经济损失。现有分析工具主要针对重入、整数溢出等具有固定控制流或数据流模式的漏洞，但近期对 Web3 安全缺陷的研究表明，约 80% 的漏洞因缺乏领域特定属性描述与检查而无法被现有工具审计。针对该问题，本文探索如何利用生成式预训练 Transformer（GPT）辅助检测逻辑漏洞，提出将 GPT 与程序分析相结合的方案 GPTScan。该方法旨在借助 GPT 的语义理解能力弥补传统静态分析在领域属性刻画上的不足。摘要未给出具体实验设置与量化结果。
Smart contracts are prone to various vulnerabilities, leading to substantial financial losses over time. Current analysis tools mainly target vulnerabilities with fixed control- or data-flow patterns, such as re-entrancy and integer overflow. However, a recent study on Web3 security bugs revealed that about 80% of these bugs cannot be audited by existing tools due to the lack of domain-specific property description and checking. Given recent advances in Large Language Models (LLMs), it is worth exploring how Generative Pre-training Transformer (GPT) could aid in detecting logic vulnerabilities.
@inproceedings{paperbot11419,
title = {GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis},
author = {Yuqiang Sun and Daoyuan Wu and Yue Xue and Han Liu and Haijun Wang and Zhengzi Xu and Xiaofei Xie and Yang Liu},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639117}
}