一句话：提出 ZepCompare，揭示 OpenZeppelin 自身漏洞并追踪其在第三方智能合约中的传播。
OpenZeppelin 是以太坊兼容链上智能合约广泛复用的基础库，此前研究多假设其自身安全，仅关注开发者误用。本文提出端到端系统 ZepCompare，揭示 OpenZeppelin 自身漏洞及其在第三方合约中的传播。作者人工审查 64 个历史版本，构建 109 对漏洞-修复代码，并引入“变更事实”结构以灵活匹配漏洞与修复上下文。在三条以太坊兼容链的 88,605 个合约上，系统检出 4,708 个源自 OpenZeppelin 的漏洞实例；人工抽样与真实标注实验显示精确率 86.7%、召回率 77.1%。结果表明历史版本乃至最新版本均存在显著安全风险，亟需对基础合约组件进行系统审计。
OpenZeppelin is a building block for many smart contracts on Ethereum-compatible blockchains. It provides mod-ular and reusable libraries for various Ethereum standards (e.g., ERC20 and ERC721) and common functionalities such as upgradeable contracts. Little research has been done on Open-Zeppelin security except for a recent study, which focused only on the misuse of OpenZeppelin code, assuming OpenZeppelin itself is secure but contract developers may not follow OpenZeppelin’s function checks appropriately. We argue that, despite appearing robust, OpenZeppelin itself could have many vulnerabilities, and these library-level vulnerabilities could inadvertently affect third-party smart contracts, even without misuse from developers.We present ZepCompare, the first end-to-end system for demystifying OpenZeppelin’s own vulnerabilities and analyzing their propagation in third-party smart contracts. ZepCompare incorporates a manual analysis stage where we review OpenZeppelin’s 64 historical releases, identifying 109 vulnerable-fixed code pairs, exposing flaws in cryptographic utilities, access control, etc. Leveraging these pairs, ZepCompare introduces facts of changes, a novel structure capturing vulnerable and fixed code contexts for flexible matching. Evaluated across 88,605 contracts from three Ethereum-compatible chains, ZepCompare detects 4,708 instances of OpenZeppelin-derived vulnerabilities. Manual sampling and a ground-truth experiment confirm that ZepCompare achieves 86.7% precision and 77.1% recall. Our findings reveal significant security risks in both historical and the latest versions of OpenZeppelin libraries, underscoring the urgent need for systematic auditing of foundational contracts components.
DOI 原文 ·
@inproceedings{paperbot9366,
title = {Demystifying OpenZeppelin’s Own Vulnerabilities and Analyzing Their Propagation in Smart Contracts},
author = {Han Liu and Daoyuan Wu and Yuqiang Sun and Shuai Wang and Yang Liu and Yixiang Chen},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00083}
}