一句话：提出 SolidiFI，通过自动缺陷注入系统评估智能合约静态分析工具，揭示漏报与误报。
针对智能合约安全漏洞频发且缺乏系统评估静态分析工具的问题，本文提出 SolidiFI——一种自动化、系统化的评估方法。SolidiFI 在智能合约所有可能位置注入缺陷，引入目标安全漏洞，再用待评估工具分析生成的有缺陷合约，从而识别工具无法检测的漏报以及误报。作者使用 50 个合约、9369 个不同缺陷，评估 Oyente、Securify、Mythril、SmartCheck、Manticore 和 Slither 六个广泛使用的工具。结果显示，这些工具漏检了许多声称可检测的漏洞，并报告大量误报。
Security attacks targeting smart contracts have been on the rise, which have led to financial loss and erosion of trust. Therefore, it is important to enable developers to discover security vulnerabilities in smart contracts before deployment. A number of static analysis tools have been developed for finding security bugs in smart contracts. However, despite the numerous bug-finding tools, there is no systematic approach to evaluate the proposed tools and gauge their effectiveness. This paper proposes SolidiFI, an automated and systematic approach for evaluating smart contracts’ static analysis tools. SolidiFI is based on injecting bugs (i.e., code defects) into all potential locations in a smart contract to introduce targeted security vulnerabilities. SolidiFI then checks the generated buggy contract using the static analysis tools, and identifies the bugs that the tools are unable to detect (false-negatives) along with identifying the bugs reported as false-positives. SolidiFI is used to evaluate six widely-used static analysis tools, namely, Oyente, Securify, Mythril, SmartCheck, Manticore and Slither, using a set of 50 contracts injected by 9369 distinct bugs. It finds several instances of bugs that are not detected by the evaluated tools despite their claims of being able to detect such bugs, and all the tools report many false positives.
@inproceedings{paperbot6037,
title = {How effective are smart contract analysis tools? evaluating smart contract static analysis tools using bug injection},
author = {Asem Ghaleb and Karthik Pattabiraman},
booktitle = {ISSTA},
year = {2020},
doi = {10.1145/3395363.3397385}
}