一句话：对四个代表性区块链的系统漏洞进行大规模实证分析，构建首个漏洞数据集并揭示模块、类型与代码模式。
本文关注底层区块链系统安全漏洞研究不足的问题，对 Bitcoin、Ethereum、Monero 和 Stellar 四个代表性区块链进行实证研究。作者设计系统化过滤流程，从 GitHub 的 34,245 个 issue/PR 与 85,164 次 commit 中识别出 1,037 个漏洞及 2,317 个补丁，构建首个区块链漏洞数据集。随后从三个层面分析：文件层面通过跨项目模块路径关联归类易受攻击模块；文本层面用自然语言处理与相似度句子聚类划分漏洞类型；代码层面生成并聚类兼具语法与语义信息的代码变更签名，提炼漏洞模式。该工作为理解区块链系统漏洞的模块、类型与代码模式提供了实证依据。
Blockchain, as a distributed ledger technology, becomes increasingly popular, especially for enabling valuable cryptocurrencies and smart contracts. However, the blockchain software systems inevitably have many bugs. Although bugs in smart contracts have been extensively investigated, security bugs of the underlying blockchain systems are much less explored. In this paper, we conduct an empirical study on blockchain’s system vulnerabilities from four representative blockchains, Bitcoin, Ethereum, Monero, and Stellar. Specifically, we first design a systematic filtering process to effectively identify 1,037 vulnerabilities and their 2,317 patches from 34,245 issues/PRs (pull requests) and 85,164 commits on GitHub. We thus build the first blockchain vulnerability dataset, which is available at https://github.com/VPRLab/BlkVulnDataset. We then perform unique analyses of this dataset at three levels, including (i) file-level vulnerable module categorization by identifying and correlating module paths across projects, (ii) text-level vulnerability type clustering by natural language processing and similarity-based sentence clustering, and (iii) code-level vulnerability pattern analysis by generating and clustering code change signatures that capture both syntactic and semantic information of patch code fragments.
DOI 原文 ·
@inproceedings{paperbot7049,
title = {An empirical study of blockchain system vulnerabilities: modules, types, and patterns},
author = {Xiao Yi and Daoyuan Wu and Lingxiao Jiang and Yuzhou Fang and Kehuan Zhang and Wei Zhang},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3549105}
}