一句话：首次系统定义智能合约中的九类密码学缺陷，并提出基于模糊测试的自动化检测工具 Crysol。
以太坊提供系统级密码学 API，超过 10% 的交易使用这些 API，开发者由此实现数字签名等链上密码学任务。但开发者未必是密码学专家，其临时且可能有缺陷的实现会破坏密码学的理论保证，引发真实安全问题。为缓解这一威胁，作者分析了 2,406 份真实安全报告，首次系统化定义了九类智能合约密码学缺陷，并给出详细描述与实用检测模式。基于此，作者提出 Crysol，一种基于模糊测试的自动化检测工具，结合交易重放与动态污点分析提取细粒度密码学相关语义，并采用密码学特定策略引导测试用例生成。作者收集了包含 25,745 个真实密码学相关智能合约的大规模数据集进行评估，Crysol 达到 95.4% 的精确率和 91.2% 的召回率，并发现 5,847 个（22.7%）合约至少包含一种密码学缺陷，表明该类缺陷十分普遍。
Ethereum has officially provided a set of system-level cryptographic APIs to enhance smart contracts with cryptographic capabilities. These APIs have been utilized in over 10% of Ethereum transactions, motivating developers to implement various on-chain cryptographic tasks, such as digital signatures. However, since developers may not always be cryptographic experts, their ad-hoc and potentially defective implementations could compromise the theoretical guarantees of cryptography, leading to real-world security issues. To mitigate this threat, we conducted the first study aimed at demystifying and detecting cryptographic defects in smart contracts. Through the analysis of 2,406 real-world security reports, we defined nine types of cryptographic defects in smart contracts with detailed descriptions and practical detection patterns. Based on this categorization, we proposed Crysol, a fuzzing-based tool to automate the detection of cryptographic defects in smart contracts. It combines transaction replaying and dynamic taint analysis to extract fine-grained crypto-related semantics and employs crypto-specific strategies to guide the test case generation process. Furthermore, we collected a large-scale dataset containing 25,745 real-world crypto-related smart contracts and evaluated CRYSOL's effectiveness on it. The result demonstrated that CRySOL achieves an overall precision of 95.4% and a recall of 91.2%. Notably, CRySOL revealed that 5,847 (22.7%) out of 25,745 smart contracts contain at least one crvptographic defect” hiahlighting the prevalence of these defects.
DOI 原文 ·
@inproceedings{paperbot8908,
title = {Demystifying and Detecting Cryptographic Defects in Ethereum Smart Contracts},
author = {Jiashuo Zhang and Yiming Shen and Jiachi Chen and Jianzhong Su and Yanlin Wang and Ting Chen and Jianbo Gao and Zhong Chen},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00010}
}