ÆGIS：保护易受攻击的智能合约免受攻击
ÆGIS: Shielding Vulnerable Smart Contracts Against Attacks
摘要：
近年来，智能合约遭受了重大攻击，损失了数百万美元。与传统程序不同，智能合约部署在区块链上。因此，一旦部署，就无法对其进行修改。尽管已经提出了各种工具来检测易受攻击的智能合约，但大多数工具都无法保护已经部署在区块链上的易受攻击的合约。迄今为止，只提出了很少的解决部署后问题的办法。然而，这些解决方案精度低，并且不足以防止任何类型的攻击。在这项工作中，我们介绍了一个动态分析工具，它可以保护智能合约在运行时不被利用。其检测新漏洞的能力可以通过所谓的攻击模式轻松扩展。这些模式是用特定于域的语言编写的，该语言是针对以太坊智能合约的执行模型而定制的。该语言支持恶意控制和数据流的描述。此外，我们提出了一种新的机制来简化和加快管理攻击模式的过程。模式通过智能合约进行投票和存储，从而利用区块链提供的防篡改和透明度的好处。我们比较了ARMGIS与当前最先进的工具，并证明了我们的解决方案在检测攻击方面具有更高的精度。最后，我们对以太坊区块链的前450万个区块进行了大规模分析，从而确认了在野外发生的已报告和未报告的攻击。
英文摘要：
In recent years, smart contracts have suffered major exploits, costing millions of dollars. Unlike traditional programs, smart contracts are deployed on a blockchain. As such, they cannot be modified once deployed. Though various tools have been proposed to detect vulnerable smart contracts, the majority fails to protect vulnerable contracts that have already been deployed on the blockchain. Only very few solutions have been proposed so far to tackle the issue of post-deployment. However, these solutions suffer from low precision and are not generic enough to prevent any type of attack. In this work, we introduce ÆGIS, a dynamic analysis tool that protects smart contracts from being exploited during runtime. Its capability of detecting new vulnerabilities can easily be extended through so-called attack patterns. These patterns are written in a domain-specific language that is tailored to the execution model of Ethereum smart contracts. The language enables the description of malicious control and data flows. In addition, we propose a novel mechanism to streamline and speed up the process of managing attack patterns. Patterns are voted upon and stored via a smart contract, thus leveraging the benefits of tamper-resistance and transparency provided by the blockchain. We compare ÆGIS to current state-of-the-art tools and demonstrate that our solution achieves higher precision in detecting attacks. Finally, we perform a large-scale analysis on the first 4.5 million blocks of the Ethereum blockchain, thereby confirming the occurrences of well reported and yet unreported attacks in the wild.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
