一句话：提出智能合约开发平台 SCStudio，通过模式学习实现实时安全增强推荐与集成测试验证，提升补全准确率并多检出约25%漏洞。
随着区块链技术普及，越来越多工程师使用智能合约实现应用。传统支持工具要么基于静态库提供代码补全，要么只能检测有限类型的漏洞，导致编码过程中的人力浪费和漏洞漏检。本文提出 SCStudio，一个统一的智能合约开发平台，旨在帮助开发者更轻松地实现更安全的智能合约。其核心思想是通过基于模式的学习实现实时安全增强推荐，并通过集成测试执行面向安全的验证。SCStudio 以 VS Code 插件形式实现，已被微众银行用作官方开发工具，并被 FISCO-BCOS 社区集成推荐。实践表明，它优于 Remix 等现有合约开发环境，平均单词建议准确率提升 30%-60%，并帮助多检测出约 25% 的漏洞。
With the increasing popularity of block-chain technologies, more and more engineers use smart contracts for application implementation. Traditional supporting tools can either provide code completions based on static libraries or detect a limited set of vulnerabilities, which results in the manpower waste during coding and miss-detection of bugs. In this work, we propose SCStudio, a unified smart contract development platform, which aims to help developers implement more secure smart contracts easily. The core idea is to realize real-time security-reinforced recommendation through pattern-based learning; and to perform security-oriented validation via integrated testing. SCStudio was implemented as a plug-in of VS Code. It has been used as the official development tool of WeBank and integrated as the recommended development tool by FISCO-BCOS community. In practice, it outperforms existing contract development environments, such as Remix, improving the average word suggestion accuracy by 30%-60% and helping detect about 25% more vulnerabilities.
DOI 原文 ·
@inproceedings{paperbot6700,
title = {SCStudio: a secure and efficient integrated development environment for smart contracts},
author = {Meng Ren and Fuchen Ma and Zijing Yin and Huizhong Li and Ying Fu and Ting Chen and Yu Jiang},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3469078}
}