一句话：提出基于学习的方法 Soleker，从 Solana 智能合约字节码中自动检测潜在漏洞。
Solana 凭借高性能和低交易成本成为支持去中心化应用的重要平台。其将代码逻辑与状态解耦的新型合约执行模型带来了新的漏洞威胁，可能给生态用户造成重大经济损失。然而，现有漏洞检测研究主要面向以太坊智能合约，由于实现语言和运行时语义差异，不适用于 Solana。本文提出 Soleker，一种利用学习技术自动识别 Solana 智能合约字节码潜在漏洞的新方法。Soleker 从与区块链交互相关的指令中捕获运行时语义信息，并提取漏洞特定的局部特征；随后引入前缀引导图学习模型来学习和整合这些特征，从而实现有效漏洞检测。作者在新构建的合约数据集上进行实验，结果表明 Soleker 显著优于基线方法，平均效果提升 126.4%，效率提升 335 倍。
Solana has rapidly evolved into a leading next generation platform for supporting decentralized applications due to its high performance and low transaction costs. Its new contract execution model, which decouples code logic from states, gives rise to new vulnerability threats that can result in significant financial losses for users within the ecosystem. However, existing studies towards detecting vulnerabilities are predominantly tailored for Ethereum smart contracts, which are unsuitable for Solana platform because of the variations in implementation languages and runtime semantics. In this paper, we propose Soleker, a novel approach that leverages learning-based techniques to automatically identifying potential vulnerabilities in Solana smart contract bytecode. More specifically, Soleker captures runtime semantic information from instructions that are associated with blockchain interactions and extracts vulnerability-specific localized features. Then, a prefix-guided graph learning model is introduced to learn and integrate extracted features, enabling effective vulnerability detection. We conduct experiments on a newly constructed contract dataset and the results demonstrate that Soleker significantly outperforms the baseline methods, achieving an average effectiveness improvement of 126.4% and a 335× boost in efficiency.
DOI 原文 ·
@inproceedings{paperbot9303,
title = {Soleker: Uncovering Vulnerabilities in Solana Smart Contracts},
author = {Kunsong Zhao and Yunpeng Tian and Zuchao Ma and Xiapu Luo},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00209}
}