一句话：提出基于字节码的静态分析框架 SmartDagger，通过恢复合约属性信息并选择性复用数据流结果，高效检测跨合约漏洞。
智能合约漏洞自动检测是区块链领域的重要问题，但已有研究大多不考虑多合约之间的交互。由于缺乏对跨合约调用过程中细粒度上下文信息的分析，现有方法往往产生大量误报与漏报。本文提出 SmartDagger，一个在字节码层面进行静态分析以检测跨合约漏洞的新框架。SmartDagger 集成多项新机制以保证检测的有效性与效率：它能够从智能合约字节码中有效恢复合约属性信息，这是准确识别跨合约漏洞的关键；同时，它不执行典型的重量级全程序分析，而是选择性地分析部分函数并复用数据流结果，从而提升效率。在人工标注数据集上的评估表明，SmartDagger 在跨合约漏洞检测上显著优于 Oyente、Slither、Osiris 和 Mythril 等先进工具。此外，在随机选取的 250 个真实智能合约上运行，SmartDagger 检测出 11 个跨合约漏洞，而这些漏洞均被先前工具遗漏。
With the increasing popularity of blockchain, automatically detecting vulnerabilities in smart contracts is becoming a significant problem. Prior research mainly identifies smart contract vulnerabilities without considering the interactions between multiple contracts. Due to the lack of analyzing the fine-grained contextual information during cross-contract invocations, existing approaches often produced a large number of false positives and false negatives. This paper proposes SmartDagger, a new framework for detecting cross-contract vulnerability through static analysis at the bytecode level. SmartDagger integrates a set of novel mechanisms to ensure its effectiveness and efficiency for cross-contract vulnerability detection. Particularly, SmartDagger effectively recovers the contract attribute information from the smart contract bytecode, which is critical for accurately identifying cross-contract vulnerabilities. Besides, instead of performing the typical whole-program analysis which is heavy-weight and time-consuming, SmartDagger selectively analyzes a subset of functions and reuses the data-flow results, which helps to improve its efficiency. Our further evaluation over a manually labelled dataset showed that SmartDagger significantly outperforms other state-of-the-art tools (i.e., Oyente, Slither, Osiris, and Mythril) for detecting cross-contract vulnerabilities. In addition, running SmartDagger over a randomly selected dataset of 250 smart contracts in the real-world, SmartDagger detects 11 cross-contract vulnerabilities, all of which are missed by prior tools.
DOI 原文 ·
@inproceedings{paperbot7416,
title = {SmartDagger: a bytecode-based static analysis approach for detecting cross-contract vulnerability},
author = {Zeqin Liao and Zibin Zheng and Xiao Chen and Yuhong Nan},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534222}
}