一句话:TransRacer 用符号执行与函数依赖分析检测智能合约交易竞态,并生成触发见证。
智能合约定义了区块链上交易的执行规则,但同一区块内交易顺序可由矿工编排,可能因交易间数据竞态(交易竞态)导致意外结果。已有工作尚未充分研究该问题。本文提出 TransRacer,一种基于符号执行的自动化方法与开源工具,用于检测智能合约中的交易竞态。它通过分析函数依赖关系,识别隐藏在特定合约状态下的交易竞态,并生成能够触发这些竞态的见证交易。在 50 个真实智能合约上的实验表明了方法的有效性与效率:共检测到 426 个竞态,耗时 255.9 分钟,其中 149 个竞态缺陷会导致状态不一致。
Smart contracts are programs that define rules for transactions running on blockchains. Since any qualified transaction sequence within the same block can be orchestrated by the blockchain miner, unexpected results may occur due to data races between transactions (called transaction races). Surprisingly, transaction races in smart contracts have not been fully investigated. To address this, we propose TransRacer, an automated approach and open-source tool that employs symbolic execution to detect transaction races in smart contracts. TransRacer analyzes function dependencies to identify transaction races hidden in specific contract states. It also generates witness transactions that can trigger such races. The experimental results on 50 real-world smart contracts show the effectiveness and efficiency of TransRacer: it detects 426 races in 255.9 minutes, including 149 race bugs leading to inconsistent states.