一句话：提出漏洞利用迁移方法，从已有 PoC 模板生成并验证智能合约漏洞 PoC，高效且无误报。
智能合约漏洞造成重大损失，PoC 可验证漏洞可利用性，但现有符号执行、模糊测试与程序合成方法难以处理复杂交易依赖和链上状态，常无法为真实事件生成 PoC。本文提出漏洞利用迁移方法：从已有 PoC 抽象环境属性、攻击逻辑与验证检查为模板，再通过克隆检测和属性可行性分析为新目标合约选择并适配模板，最后在模拟环境中生成验证。评估在 67 个手工验证案例中成功生成 62 个有效 PoC 且无误报，耗时 3.8 小时，远低于现有工具的 133.2 和 210.5 小时；对 979,512 个合约分析发现 256 个漏洞合约，含 64 个跨链案例。
Smart contract vulnerabilities continue to cause significant financial losses, despite the implementation of security measures such as manual audits and bug bounty platforms. A critical component often required by these security measures is the proof-of-concept (PoC) exploit, which validates vulnerability exploitability, assesses impact severity, and guides developers in fixes. Existing tools have explored automated PoC generation with techniques like symbolic execution, fuzzing, and program synthesis. However, these approaches frequently fail to generate PoCs for vulnerabilities exploited in real-world incidents, primarily due to their limitations in handling complex transaction dependencies, navigating vast on-chain state spaces, or requiring extensive manual specifications. Our migration-based approach extracts critical information from documented security incidents and applies it to generate PoCs for similar vulnerable code. This approach leverages proven exploit patterns rather than generating PoCs from scratch. This approach is motivated by two key observations: the prevalence of code reuse in smart contracts (up to 90% at the function level) and the increasing availability of documented PoCs for real-world incidents. Our approach operates in three phases: (1) abstracting essential components (i.e., environment properties, attack logic, and verification checks) from existing PoCs into templates, (2) given a new target contract, selecting suitable templates with adapted values through clone-detection and property-feasibility analysis, and (3) generating and validating PoCs in simulated environments. Our evaluation demonstrates effectiveness and efficiency across multiple scales. Our approach successfully generates valid PoCs for 62 out of 67 manually validated cases without false positives and completes analysis in 3.8 hours compared to 133.2 and 210.5 hours required by existing tools. Large-scale evaluation on 979,512 contracts identifies 256 vulnerable contracts across blockchain networks with 64 cross-chain cases, demonstrating real-world applicability.
DOI 原文 ·
@inproceedings{paperbot9409,
title = {Learning from the Past: Real-World Exploit Migration for Smart Contract PoC Generation},
author = {Kairan Sun and Zhengzi Xu and Kaixuan Li and Lyuye Zhang and Yebo Feng and Daoyuan Wu and Yang Liu},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00013}
}