一句话：提出“公平性缺陷”概念，并用跨过程、跨合约的符号执行与 SMT 静态分析自动检测 DeFi 合约中可零成本获利的窃取资金漏洞。
DeFi 协议管理巨额资产，成为攻击重点；现有工具多沿用传统软件分析的 oracle 思路，难以捕捉 DeFi 特有的功能性缺陷。论文观察到，区块链是分布式账本，协议正确性依赖准确维护表示用户资金的关键状态变量。基于对流行协议的研究，作者提出：为保证交易不侵占他人资金，用户资产与债务相关数值的变化方向必须满足特定公平性质，违反即可零成本获利，称为 fairness bug。作者设计了跨过程、跨合约的静态分析技术，结合符号执行与 SMT 求解自动检测此类缺陷，实现工具 FairChecker。在 113 个真实 DeFi 协议、含 34 个公平性缺陷的基准上检出 32 个，召回率 94.1%、精确率 46.4%。
Decentralized Finance (DeFi) is an emerging paradigm within the blockchain space that aims to revolutionize conventional financial systems by applying blockchain technology. The substantial value of digital assets managed by DeFi protocols makes it a lucrative target for attacks. Despite the human resources and the application of automated tools, frequent attacks still cause significant fund losses to DeFi participants. Existing tools primarily rely on oracles similar to those used in traditional software analysis, making it challenging for them to detect functional bugs specific to the DeFi domain. Since blockchain functions as a distributed ledger system, the foundation of any DeFi protocol is the accurate maintenance of key state variables representing user funds. If these variables are not properly updated or designed to reflect the intended flow of funds, attackers can exploit these flaws to steal assets. From the study of popular DeFi protocols, we observe that, in DeFi systems, to ensure a transaction does not misappropriate someone's fund, the direction of changes (increase or decrease) of values associated with the amount of asset or debt of a user has to adhere to some fairness properties. We propose a concept called fairness bug which allows attackers to gain profit without cost. We propose an inter-procedural and inter-contract static analysis technique that utilizes symbolic execution and an SMT solver to automatically detect fairness bugs in DeFi smart contracts. We have implemented our fairness-checking approach in our tool, named FairChecker. We evaluate our tool on a benchmark of 113 real-world DeFi protocols with 34 fairness bugs. The results show that our tool can detect 32 bugs with a recall of 94.1 % and a precision of 46.4 %, demonstrating its effectiveness.
DOI 原文 ·
@inproceedings{paperbot8924,
title = {FairChecker: Detecting Fund-Stealing Bugs in DeFi Protocols via Fairness Validation},
author = {Yi Sun and Zhuo Zhang and Xiangyu Zhang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00134}
}