一句话：提出 Tx2TXT，从智能合约字节码自动生成以安全为中心的文本描述，帮助用户规避风险合约。
智能合约与 DApp 用户往往缺乏必要知识来识别脆弱或恶意代码，从而面临巨大风险。本文提出 Tx2TXT 系统，可直接从智能合约字节码自动生成以安全为中心的文本描述。为刻画金融应用的安全属性，作者形式化定义了资金转移图来建模关键资金流；为确保描述的简洁与表达力，采用基于 GCN 的模型识别与安全相关的条件语句，并选择性地加入图模型。系统还利用稳健的 API 签名恢复字节码语义，将底层字节码指令转化为人类可读的文本脚本。在 890 个具有开发者描述且标注为脆弱、恶意或安全的合约上进行评估，结果表明 Tx2TXT 优于当前最先进方案，能有效帮助终端用户避开高风险合约。
Smart contract and DApp users are taking great risks, as they do not obtain necessary knowledge that can help them avoid using vulnera- ble and malicious contract code. In this paper, we develop a novel system Tx2TXT that can automatically create security-centric textual descriptions directly from smart contract bytecode. To capture the security aspect of financial applications, we formally define a funds transfer graph to model critical funds flows in smart contracts. To ensure the expressiveness and conciseness of the descriptions de- rived from these graphs, we employ a GCN-based model to identify security-related condition statements and selectively add them to our graph models. To convert low-level bytecode instructions to human- readable textual scripts, we leverage robust API signatures to recover bytecode semantics. We have evaluated Tx2TXT on 890 well-labeled vulnerable, malicious and safe contracts where developer-crafted descriptions are available. Our results have shown that Tx2TXT out- performs state-of-the-art solutions and can effectively help end users avoid risky contracts
@inproceedings{PanXLY023,
title = {Automated Generation of Security-Centric Descriptions for Smart Contract Bytecode},
author = {Yu Pan and Zhichao Xu and Levi Taiji Li and Yunhe Yang and Mu Zhang},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598132}
}