一句话：提出 SOChecker，首个面向 Stack Overflow 不完整智能合约代码片段的漏洞检测工具，结合微调 Llama2 补全与符号执行。
智能合约开发者经常在 Stack Overflow（SO）等问答平台上寻求开发问题的解决方案，但社区回答中的代码片段可能隐藏漏洞，直接复用到合约中会带来被攻击的风险。作者开展在线调查并收到 74 份开发者回复，结果显示多数（86.4%）受访者在复用 SO 代码片段时并未充分考虑安全性；而现有漏洞检测工具通常针对完整合约开发，无法有效分析 SO 上典型的不完整片段。为此，作者提出 SOChecker：先利用微调的 Llama2 模型进行代码补全，再对补全后的代码应用符号执行方法进行漏洞检测。在从智能合约相关 SO 帖子收集的 897 条代码片段数据集上，SOChecker 取得了 68.2% 的 F1 分数，大幅超过 GPT-3.5（20.9%）与 GPT-4（33.2%）。研究结果凸显了提升问答网站代码片段安全性的必要性。
Smart contract developers frequently seek solutions to developmental challenges on Q&A platforms such as Stack Overflow (SO). Although community responses often provide viable solutions, the embedded code snippets can also contain hidden vulnerabilities. Integrating such code directly into smart contracts may make them susceptible to malicious attacks. We conducted an online survey and received 74 responses from smart contract developers. The results of this survey indicate that the majority (86.4%) of participants do not sufficiently consider security when reusing SO code snippets. Despite the existence of various tools designed to detect vulnerabilities in smart contracts, these tools are typically developed for analyzing fully-completed smart contracts and thus are ineffective for analyzing typical code snippets as found on SO. We introduce SOChecker, the first tool designed to identify potential vulnerabilities in incomplete SO smart contract code snippets. SOChecker first leverages a fine-tuned Llama2 model for code completion, followed by the application of symbolic execution methods for vulnerability detection. Our experimental results, derived from a dataset comprising 897 code snippets collected from smart contract-related SO posts, demonstrate that SOChecker achieves an F1 score of 68.2%, greatly surpassing GPT-3.5 and GPT-4 (20.9% and 33.2% F1 Scores respectively). Our findings underscore the need to improve the security of code snippets from Q&A websites.
@inproceedings{paperbot8457,
title = {Identifying Smart Contract Security Issues in Code Snippets from Stack Overflow},
author = {Jiachi Chen and Chong Chen and Jiang Hu and John Grundy and Yanlin Wang and Ting Chen and Zibin Zheng},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680353}
}