一句话：提出 InsFinder，用跨 DApp 动态污点分析、源映射与静态分析检测 DApp 间不安全状态依赖。
DApp 间日益互联，可依赖其他 DApp 获取最新数据，但深度依赖引入更多攻击面。作者将这种相互依赖引发的安全威胁称为不安全状态依赖（ISD），公开报告显示其损失超 3.4 亿美元。自动发现 ISD 的难点在于：在交织且不可见的 DApp 交互中精确追踪数据，并从低语义字节码中获取细粒度语义。为此提出 InsFinder：用动态跨 DApp 污点分析实现多源数据追踪，用源映射将字节码标识符映射为源代码信息，并用细粒度访问控制与静态分析检测 ISD 入口点。在 93 个真实 ISD 上检出 72 个，精确率 84.7%、召回率 77.4%；并在 122 个 DApp 项目中发现 165 个未报告 ISD，影响超 200 万美元。
Decentralized Applications (DApps) serve as the gateway to utilizing blockchain technology. As their prevalence continues to grow, DApps are becoming increasingly interconnected. For instance, a DApp does not need to manage the prices of various tokens internally, as it can retrieve this information from other DApps that provide more up-to-date data. However, such deep reliance also introduces more attack surfaces, posing greater risks to both DApps and their users. In this paper, we refer to the security threat arising from the interdependence of DApps as Insecure State Dependency (ISD). Public reports indicate that ISD has led to losses exceeding 340 million USD.Existing ISDs are mostly found by extensive manual auditing and lucky incidents, as automated discovery of such issues is extremely difficult. More specifically, it is by no means trivial to (1) achieve precise data tracking in the intertwined and invisible interactions of DApps, (2) obtain fine-grained semantic information in low semantic bytecode. In this paper, we propose a novel framework, called InsFinder, for detecting ISD in DApps. Specifically, InsFinder consists of three unique modules to overcome the aforementioned challenges. (1) InsFinder employs dynamic cross-DApp taint analysis to achieve accurate multi-source data tracking in heavily coupled DApp interactions. (2) InsFinder uses source mapping to map bytecode identifiers into meaningful source code, such as variable names or statements, enabling a deeper understanding of bytecode. (3) InsFinder implements fine-grained access control and static analysis for ISD entry point detection. Evaluation on a manually annotated dataset with 93 real-world ISDs shows that InsFinder successfully detects 72 of them, achieving a precision of 84.7% and a recall of 77.4%. Furthermore, InsFinder successfully uncovers 165 previously unreported ISDs across 122 DApp projects. These ISDs collectively impact over 2 million USD.
DOI 原文 ·
@inproceedings{paperbot9575,
title = {Finding Insecure State Dependency in DApps via Multi-Source Tracing and Semantic Enrichment},
author = {Jingwen Zhang and Yuhong Nan and Wei Li and Kaiwen Ning and Zewei Lin and Zitong Yao and Yuming Feng and Weizhe Zhang and Zibin Zheng},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00129}
}