一句话：提出 SmartState，通过字节码与交易历史的细粒度状态依赖分析检测 Solidity 合约中的状态回滚漏洞。
Solidity 智能合约常用状态回滚（revert）机制处理错误与访问控制，但攻击者可利用该机制操纵合约关键状态，造成非法获利或拒绝服务等后果，论文将此类漏洞称为状态回滚漏洞（SRV）。检测 SRV 的难点在于深入理解合约中的状态依赖关系。SmartState 从合约字节码和历史交易中抽取状态依赖，将非法获利与 DoS 两类通用 SRV 模式建模为 SRV 指标，并基于构建的状态依赖图识别漏洞。在人工标注的 91 个真实 SRV 数据集上，其精确率为 87.23%、召回率为 89.13%；并从 47,351 个真实合约中发现 406 个新 SRV，其中 11 个来自交易量高的前 2000 合约，涉及数字资产约 428,600 美元。
Smart contracts written in Solidity are widely used in different blockchain platforms such as Ethereum, TRON and BNB Chain. One of the unique designs in Solidity smart contracts is its statereverting mechanism for error handling and access control. Unfortunately, a number of recent security incidents showed that adversaries also utilize this mechanism to manipulate critical states of smart contracts, and hence, bring security consequences such as illegal profit-gain and Deny-of-Service (DoS). In this paper, we call such vulnerabilities as the State-reverting Vulnerability (SRV). Automatically identifying SRVs poses unique challenges, as it requires an in-depth analysis and understanding of the state-dependency relations in smart contracts. This paper presents SmartState, a new framework for detecting state-reverting vulnerability in Solidity smart contracts via finegrained state-dependency analysis. SmartState integrates a set of novel mechanisms to ensure its effectiveness. Particularly, Smart- State extracts state dependencies from both contract bytecode and historical transactions. Both of them are critical for inferring dependencies related to SRVs. Further, SmartState models the generic patterns of SRVs (i.e., profit-gain and DoS) as SRV indicators, and hence effectively identify SRVs based on the constructed statedependency graph. To evaluate SmartState, we manually annotated a ground-truth dataset which contains 91 SRVs in the real world. Evaluation results showed that SmartState achieves a precision of 87.23% and a recall of 89.13%. In addition, SmartState successfully identifies 406 new SRVs from 47,351 real-world smart contracts. 11 of these SRVs are from popular smart contracts with high transaction amounts (i.e., top 2000). In total, our reported SRVs affect a total amount of digital assets worth 428,600 USD.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2406-15988,
title = {SmartState: Detecting State-Reverting Vulnerabilities in Smart Contracts via Fine-Grained State-Dependency Analysis},
author = {Zeqin Liao and Sicheng Hao and Yuhong Nan and Zibin Zheng},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598111}
}