paperbot · PL 论文追踪

全部论文 待读 收藏

P2 USCSA: Evolution-Aware Security Analysis for Proxy-Based Upgradeable Smart Contracts

USCSA：面向基于代理的可升级智能合约的演化感知安全分析
ICSE Proceedings of the IEEE/ACM 48th International Conference on Software Engineering2026匹配度 4/10 · 论文采用 AST 差异分析 + LLM 推理的组合，方法形态上与画像中“用 LLM/Agent 改进静态分析”这一方向有交集；但应用领域是区块链可升级智能合约的安全漏洞检测，与画像关注的 ML 系统/Agentic 程序、浮点程序分析、贝叶斯程序分析均无重叠，且论文偏领域工具型贡献，缺乏理论形式化或面向新场景的基准设计。引用 0 inbox
Xiaoqi Li, Lei Xie, Wenkai Li, Zongwei Li
安全与隐私程序分析与抽象解释机器学习与程序语言
crossref: 2026-09-12

AI 速览

一句话：USCSA 结合 AST 差异分析与大语言模型推理，检测代理式可升级合约在升级过程中引入的漏洞。

可升级智能合约需要持续升级与维护，而升级操作本身常引入新的漏洞；现有静态分析工具通常只扫描单一版本，无法刻画代码变更与新增风险之间的关联。为此，作者提出可升级智能合约安全分析器 USCSA：它利用抽象语法树（AST）差异分析评估升级过程带来的风险，并借助大语言模型（LLM）进行辅助推理，实现高置信度的漏洞归因。作者收集并分析了 3,546 个可升级合约漏洞案例，覆盖重入、访问控制缺陷、整数溢出等常见类别。实验结果显示，USCSA 在检测升级引入漏洞上达到 92.26% 的精确率、89.67% 的召回率与 90.95% 的 F1 值，为区块链应用的安全审计提供了一种高效的新方案。

问题
可升级智能合约在升级与后续维护中经常引入新漏洞，而已有静态分析工具只扫描单个版本，无法捕捉代码变更与新兴风险之间的关联。
方法
提出 USCSA，对合约版本间的抽象语法树（AST）做差异分析以评估升级相关风险，并利用大语言模型（LLM）辅助推理，实现高置信度的漏洞归因。
评估
收集并分析 3,546 个可升级合约漏洞案例，覆盖重入、访问控制缺陷、整数溢出等类别；在升级引入漏洞的检测上取得 92.26% 精确率、89.67% 召回率和 90.95% F1 值。
原文摘要（Abstract）

In the case of upgrading smart contracts on blockchain systems, it is essential to consider the continuity of upgrades and subsequent maintenance. In practice, upgrade operations often introduce new vulnerabilities. Existing static analysis tools usually only scan a single version and are unable to capture the correlation between code changes and emerging risks. To address this, we propose an Upgradeable Smart Contract Security Analyzer, USCSA, which uses Abstract Syntax Tree (AST) difference analysis to assess risks associated with the upgrade process and utilizes large language models (LLMs) for assisted reasoning to achieve high-confidence vulnerability attribution. We collected and analyzed 3,546 cases of vulnerabilities in upgradeable contracts, covering common vulnerability categories such as reentrancy, access control flaws, and integer overflow. Experimental results show that USCSA achieves a precision of 92.26%, a recall of 89.67%, and an F1-score of 90.95% in detecting upgrade-induced vulnerabilities. As a result, USCSA provides a significant advantage to improve the security and integrity of upgradeable smart contracts, offering a novel and efficient solution for security auditing on blockchain applications.

链接与引用

DOI 原文 · PDF（开放获取） ·

BibTeX 
@inproceedings{paperbot12002,
  title = {USCSA: Evolution-Aware Security Analysis for Proxy-Based Upgradeable Smart Contracts},
  author = {Xiaoqi Li and Lei Xie and Wenkai Li and Zongwei Li},
  booktitle = {ICSE},
  year = {2026},
  doi = {10.1145/3786582.3786824}
}