一句话：通过挖掘合约历史交易恢复访问控制模型，检测智能合约权限漏洞。
智能合约常实现访问控制策略以保护资产，但策略规约缺失，导致难以验证合约实现是否符合预期权限行为。本文提出通过挖掘合约历史交易来恢复可能的访问控制模型，进而针对多种信息流策略进行检查，识别用户权限相关的潜在缺陷，并在工具 SPCon 中实现角色挖掘与安全策略验证。在带标注的角色挖掘基准上，SPCon 比现有工具挖掘出更准确的用户角色；在真实智能合约基准和访问控制 CVE 上，SPCon 能有效检测权限缺陷，且可扩展性更好、误报率更低，发现 11 个此前未知的缺陷，并检测出其他工具无法发现的 6 个 CVE。
Smart contracts deployed on permissionless blockchains, such as Ethereum, are accessible to any user in a trustless environment. Therefore, most smart contract applications implement access control policies to protect their valuable assets from unauthorized accesses. A difficulty in validating the conformance to such policies, i.e., whether the contract implementation adheres to the expected behaviors, is the lack of policy specifications. In this paper, we mine past transactions of a contract to recover a likely access control model, which can then be checked against various information flow policies and identify potential bugs related to user permissions. We implement our role mining and security policy validation in tool SPCon. The experimental evaluation on labeled smart contract role mining benchmark demonstrates that SPCon effectively mines more accurate user roles compared to the state-of-the-art role mining tools. Moreover, the experimental evaluation on real-world smart contract benchmark and access control CVEs indicates SPCon effectively detects potential permission bugs while having better scalability and lower false-positive rate compared to the state-of-the-art security tools, finding 11 previously unknown bugs and detecting six CVEs that no other tool can find.
DOI 原文 ·
@inproceedings{paperbot7421,
title = {Finding permission bugs in smart contracts with role mining},
author = {Ye Liu and Yi Li and Shang-Wei Lin and Cyrille Artho},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534372}
}