一句话：首个 Move 合约安全实证研究，归纳出八类缺陷并提出自动化检测框架 MoveScan。
Move 语言以安全为设计卖点，但其合约在真实场景中的安全效果尚不清楚。本文开展首个针对 Move 合约安全性的综合性实证研究：首先与安全公司合作，人工审计来自 92 个 Move 项目的 652 份合约，归纳出八类缺陷，其中一半为此前未被报告的缺陷，这些缺陷会带来安全风险、功能缺陷、误导用户或浪费计算资源。为评估这些缺陷在真实合约中的普遍程度，作者提出 MoveScan——一个自动化分析框架，将字节码翻译为中间表示（IR），提取关键元信息，并检测全部八类缺陷。借助 MoveScan，作者在 Aptos 与 Sui 区块链上全部 37,302 份已部署合约中发现了 97,028 个缺陷，说明缺陷极为普遍。实验显示 MoveScan 精度达 98.85%，平均项目分析时间仅 5.45 毫秒，优于 MoveLint（准确率 87.50%、平均 71.72 毫秒）和需人工介入且召回率仅 6.02% 的 Move Prover。
Move, a programming language for smart contracts, stands out for its focus on security. However, the practical security efficacy of Move contracts remains an open question. This work conducts the first comprehensive empirical study on the security of Move contracts. Our initial step involves collaborating with a security company to manually audit 652 contracts from 92 Move projects. This process reveals eight types of defects, with half previously unreported. These defects present potential security risks, cause functional flaws, mislead users, or waste computational resources. To further evaluate the prevalence of these defects in real-world Move contracts, we present MoveScan, an automated analysis framework that translates bytecode into an intermediate representation (IR), extracts essential meta-information, and detects all eight defect types. By leveraging MoveScan, we uncover 97,028 defects across all 37,302 deployed contracts in the Aptos and Sui blockchains, indicating a high prevalence of defects. Experimental results demonstrate that the precision of MoveScan reaches 98.85%, with an average project analysis time of merely 5.45 milliseconds. This surpasses previous state-of-the-art tools MoveLint, which exhibits an accuracy of 87.50% with an average project analysis time of 71.72 milliseconds, and Move Prover, which has a recall rate of 6.02% and requires manual intervention. Our research also yields new observations and insights that aid in developing more secure Move contracts.
DOI 原文 ·
@inproceedings{paperbot8449,
title = {Empirical Study of Move Smart Contract Security: Introducing MoveScan for Enhanced Analysis},
author = {Shuwei Song and Jiachi Chen and Ting Chen and Xiapu Luo and Teng Li and Wenwu Yang and Leqing Wang and Weijie Zhang and Feng Luo and Zheyuan He and Yi Lu and Pan Li},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680391}
}