一句话：提出可扩展执行框架 SmartBugs，统一运行与比较 Solidity 智能合约分析工具，并提供漏洞与真实合约数据集。
智能合约的自动化分析、测试与调试已有大量研究，但不同工作之间难以复现和比较。为此，作者提出 SmartBugs，一个可扩展且易用的执行框架，用于在 Solidity 编写的智能合约上运行分析工具。SmartBugs 当前集成 10 个工具和两个数据集：一个包含 143 个带标注漏洞的合约、共 208 个标签漏洞，可用于评估分析精度；另一个包含从 Etherscan 收集的 47,518 个唯一合约。该框架支持迄今在工具数量和执行时间上规模最大的实验，并便于集成与比较分析工具。作者还通过扩展 SmartCheck 展示了其可扩展性，使 DASP10 中 Bad Randomness、Time Manipulation 和 Access Control 相关漏洞检出率从 11% 提升至 24%。
Over the last few years, there has been substantial research on automated analysis, testing, and debugging of Ethereum smart contracts. However, it is not trivial to compare and reproduce that research. To address this, we present SmartBugs, an extensible and easy-to-use execution framework that simplifies the execution of analysis tools on smart contracts written in Solidity, the primary language used in Ethereum. SmartBugs is currently distributed with support for 10 tools and two datasets of Solidity contracts. The first dataset can be used to evaluate the precision of analysis tools, as it contains 143 annotated vulnerable contracts with 208 tagged vulnerabilities. The second dataset contains 47,518 unique contracts collected through Etherscan. We discuss how SmartBugs supported the largest experimental setup to date both in the number of tools and in execution time. Moreover, we show how it enables easy integration and comparison of analysis tools by presenting a new extension to the tool SmartCheck that improves substantially the detection of vulnerabilities related to the DASP10 categories Bad Randomness, Time Manipulation, and Access Control (identified vulnerabilities increased from 11% to 24%).
DOI 原文 ·
@inproceedings{paperbot5986,
title = {SmartBugs},
author = {João F. Ferreira and Pedro Cruz and Thomas Durieux and Rui Abreu},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3415298}
}