一句话：SmartCoCo 通过约束传播与绑定策略自动检测智能合约中注释与代码在角色、参数、事件上的不一致，精度超过 79%。
智能合约源码中的注释有助于开发者理解代码，但由于 ERC-20、ERC-721 等代币标准常被复制粘贴为模板再添加自定义逻辑，注释与代码往往脱节，形成注释-代码不一致（CCI），不仅会误导开发者与用户，还可能引入安全漏洞。本文提出 SmartCoCo，一个自动检测智能合约注释-代码不一致的框架，聚焦与角色、参数和事件相关、可能带来安全隐患的注释。SmartCoCo 以合约源码为输入，将注释约束与代码事实通过一组传播与绑定策略相互关联，从而借助更丰富的上下文信息发现不一致。作者在以太坊上 101,780 个唯一合约上进行了评估：SmartCoCo 从 1,745 个合约中报告 4,732 处不一致，在 439 个人工标注的不一致上精度超过 79%，平均检查一个合约仅需 2.64 秒，兼具效果与效率。
Smart contracts are programs running on the blockchain. Comments in source code provide meaningful information for developers to facilitate code writing and understanding. Given various kinds of token standards in smart contracts (e.g., ERC-20, ERC-721), developers often copy&paste code from other projects as templates, and then implement their own logic as add-ons to such templates. In many cases, the consistency between code and comment is not well-aligned, leading to comment-code inconsistencies (as we call CCIs). Such inconsistencies can mislead developers and users, and even introduce vulnerabilities to the contracts. In this paper, we present SmartCoCo, a novel framework to detect comment-code inconsistencies in smart contracts. In particular, our research focuses on comments related to roles, parameters, and events that may lead to security implications. To achieve this, SmartCoCo takes the original smart contract source code as input and automatically analyzes the comment and code to find potential inconsistencies. SmartCoCo associates comment constraints and code facts via a set of propagation and binding strategies, allowing it to effectively discover inconsistencies with more contextual information. We evaluated SmartCoCo on 101,780 unique smart contracts on Ethereum. The evaluation result shows that SmartCoCo achieves good effectiveness and efficiency. In particular, SmartCoCo reports 4,732 inconsistencies from 1,745 smart contracts, with a precision of over 79% on 439 manual-labeled comment-code inconsistencies. Meanwhile, it only takes 2.64 seconds to check a smart contract on average.
@inproceedings{HaoNZL23,
title = {SmartCoCo: Checking Comment-Code Inconsistency in Smart Contracts via Constraint Propagation and Binding},
author = {Sicheng Hao and Yuhong Nan and Zibin Zheng and Xiaohui Liu},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00142}
}