一句话：提出 SoMo 工具，通过修饰符依赖图与符号路径约束检测以太坊智能合约中可被绕过的自定义函数修饰符。
智能合约函数默认可被任意调用，Solidity 的 modifier 机制允许定义超越 protected/private 的自定义访问控制。本文对以太坊真实合约中的 modifier 开展大规模安全分析，设计实现 SoMo 工具，自动识别可从无保护函数绕过的非安全 modifier。针对 modifier 与变量/函数间复杂依赖及攻击入口歧义，提出 Modifier Dependency Graph 连接相关控制/数据流，在图上建模系统变量、生成符号路径约束并迭代测试候选入口函数。评估中，SoMo 覆盖 SPCon 全部真阳性并正确排除 11 个假阳性中的 9 个；在 62,464 个合约上精度 91.2%，发现 400 余个可绕过的合约，总结出三类安全发现与九种使用模式，并集成至 MetaScan。
A smart contract is a piece of application-layer code running on blockchain ledgers and it provides programmatic logic via transaction-based execution of pre-defined functions. Smart contract functions are by default invokable by any party. To safeguard them, the mainstream smart contract language, i.e., Solidity of the popular Ethereum blockchain, proposed a unique language-level keyword called “modifier,” which allows developers to define custom function access control policies beyond the traditional “protected” and “private” modifiers in classic programming languages. In this paper, we aim to conduct a large-scale security analysis of the modifiers used in real-world Ethereum smart contracts. To achieve this, we design and implement a novel smart contract analysis tool called SoMo. Its main objective is to identify insecure modifiers that can be bypassed from one or more unprotected smart contract functions. This is challenging because of the complicated relationship between modifiers and their variables/functions and the ambiguity of attacker-accessible entry functions. To overcome them, we first propose a new structure, the Modifier Dependency Graph (MDG), to connect all the modifier-related control/data flows. Over MDGs, we then model system variables, generate symbolic path constraints, and iteratively test each candidate entry function. Our extensive evaluation shows that SoMo outperforms the state-of-the-art SPCon tool by detecting all its true positives and correctly avoiding 9 out of 11 false positives. It also achieves high precision of 91.2% when analyzing a large dataset of 62,464 contracts, over 400 of which were identified with bypassable modifiers. Our analysis further reveals three interesting security findings about modifiers and nine major types of modifier usage in the wild. SoMo has been integrated into an online security scanning service, MetaScan.
@inproceedings{FangWYWCCLJ23,
title = {Beyond “Protected” and “Private”: An Empirical Security Analysis of Custom Function Modifiers in Smart Contracts},
author = {Yuzhou Fang and Daoyuan Wu and Xiao Yi and Shuai Wang and Yufan Chen and Mengjie Chen and Yang Liu and Lingxiao Jiang},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598125}
}