一句话：提出 SmartBugs 2.0 模块化执行框架，为 19 种智能合约弱点检测工具提供统一接口，支持 Solidity 与 EVM 字节码。
智能合约常管理高价值资产，但编写安全的合约十分困难，漏洞可能导致重大经济损失。已有多种自动化分析方法和工具，然而缺少公认的基准套件与性能指标，且工具在接口、报告格式和运行环境上差异较大，逐个安装耗时，难以比较和评估。本文提出 SmartBugs 2.0，一个模块化执行框架，为 19 种智能合约分析工具提供统一接口，并同时接受 Solidity 源码和 EVM 字节码输入。文章介绍其架构并突出框架特性，随后通过社区采用情况评估其影响力，并通过描述其在包含 325 万次分析的研究中所起的作用来展示可扩展性。
Smart contracts are blockchain programs that often handle valuable assets. Writing secure smart contracts is far from trivial, and any vulnerability may lead to significant financial losses. To support developers in identifying and eliminating vulnerabilities, methods and tools for the automated analysis of smart contracts have been proposed. However, the lack of commonly accepted benchmark suites and performance metrics makes it difficult to compare and evaluate such tools. Moreover, the tools are heterogeneous in their interfaces and reports as well as their runtime requirements, and installing several tools is time-consuming. In this paper, we present SmartBugs 2.0, a modular execution framework. It provides a uniform interface to 19 tools aimed at smart contract analysis and accepts both Solidity source code and EVM bytecode as input. After describing its architecture, we highlight the features of the framework. We evaluate the framework via its reception by the community and illustrate its scalability by describing its role in a study involving 3.25 million analyses.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2306-05057,
title = {SmartBugs 2.0: An Execution Framework for Weakness Detection in Ethereum Smart Contracts},
author = {Monika di Angelo and Thomas Durieux and João F. Ferreira and Gernot Salzer},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00060}
}