一句话：首次实证研究智能合约签名重放漏洞，并提出 LLM 辅助静态污点分析结合符号执行的检测工具 LASiR。
数字签名是智能合约权限验证的关键机制，但若合约未检查签名的使用条件，同一签名可能被反复验证，导致权限滥用与资产风险，作者将此定义为签名重放漏洞（SRV）。本文首次对 SRV 进行实证研究：从 37 家区块链安全公司的 1,419 份审计报告中筛选出 108 份含详细 SRV 描述的样本，归纳出五类 SRV。为自动检测该漏洞，作者设计了 LASiR，利用大语言模型（LLM）的通用语义理解能力辅助签名状态的静态污点分析，识别签名重用行为，并通过符号执行进行路径可达性验证以保证检测的有效性与可靠性。评估在 Ethereum、Binance Smart Chain、Polygon 和 Arbitrum 四条链的 918,964 份合约中筛出的 15,383 份含签名验证的合约上展开，发现 SRV 广泛存在，受影响合约持有 476 万美元活跃资产，以太坊上 19.63% 的签名使用合约含 SRV；人工验证显示 LASiR 检测 F1 达 87.90%，消融与对比实验表明 LLM 提供的语义信息能显著提升检测性能。
Smart contracts have significantly advanced blockchain technology, and digital signatures are crucial for reliable verification of contract authority. Through signature verification, smart contracts can ensure that signers possess the required permissions, thus enhancing security and scalability. However, lacking checks on signature usage conditions can lead to repeated verifications, increasing the risk of permission abuse and threatening contract assets. We define this issue as the Signature Replay Vulnerability (SRV). In this paper, we conducted the first empirical study to investigate the causes and characteristics of the SRVs. From 1,419 audit reports across 37 blockchain security companies, we identified 108 with detailed SRV descriptions and classified five types of SRVs. To detect these vulnerabilities automatically, we designed LASiR, which utilizes the general semantic understanding ability of Large Language Models (LLMs) to assist in the static taint analysis of the signature state and identify the signature reuse behavior. It also employs path reachability verification via symbolic execution to ensure effective and reliable detection. To evaluate the performance of LASiR, we conducted large-scale experiments on 15,383 contracts involving signature verification, selected from the initial dataset of 918,964 contracts across four blockchains: Ethereum, Binance Smart Chain, Polygon, and Arbitrum. The results indicate that SRVs are widespread, with affected contracts holding $4.76 million in active assets. Among these, 19.63% of contracts that use signatures on Ethereum contain SRVs. Furthermore, manual verification demonstrates that LASiR achieves an F1-score of 87.90% for detection. Ablation studies and comparative experiments reveal that the semantic information provided by LLMs aids static taint analysis, significantly enhancing LASiR’s detection performance.
@inproceedings{abs-2511-09134,
title = {One Signature, Multiple Payments: Demystifying and Detecting Signature Replay Vulnerabilities in Smart Contracts},
author = {Zexu Wang and Jiachi Chen and Zewei Lin and Wenqing Chen and Kaiwen Ning and Jianxing Yu and Yuming Feng and Yu Zhang and Weizhe Zhang and Zibin Zheng},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773198}
}