DEFECTCHECKER：通过分析EVM字节码自动检测智能合约缺陷
DEFECTCHECKER: Automated Smart Contract Defect Detection by Analyzing EVM Bytecode
摘要：
智能合约是在区块链上运行的图灵完备程序。它们是不可变的，即使检测到bug也不能修改。因此，在将智能合约部署到区块链之前，确保智能合约没有错误并且设计良好非常重要。合约缺陷是智能合约中的错误、缺陷或故障，导致其产生不正确或意外的结果，或以非预期的方式表现。检测和删除合约缺陷可以避免潜在的错误，使程序更健壮。我们之前的工作为智能合约定义了20个合约缺陷，并将其分为五个影响级别。根据我们的分类，严重性级别在1-3之间的合同缺陷可能导致不必要的行为，例如，一份由攻击者控制的合同在本文中，我们提出了一种基于符号执行的方法和工具，用于检测八种可能导致以太坊区块链平台上智能合约出现不必要行为的合约缺陷。DefectMind可以从智能合约字节码中检测合约缺陷。我们使用开源数据集将Defectoral与以前的主要作品进行比较，包括Oyente，Mythril和Securify。我们的实验结果表明，在速度和准确性方面，Defectomy比这些工具表现得更好。我们还在以太坊平台上的165，621个不同的智能合约中应用了Defectrance。我们发现，这些智能合约中有25，815个包含至少一个属于影响级别1-3的合约缺陷，包括一些现实世界的攻击。
英文摘要：
Smart contracts are Turing-complete programs running on the blockchain. They are immutable and cannot be modified, even when bugs are detected. Therefore, ensuring smart contracts are bug-free and well-designed before deploying them to the blockchain is extremely important. A contract defect is an error, flaw or fault in a smart contract that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. Detecting and removing contract defects can avoid potential bugs and make programs more robust. Our previous work defined 20 contract defects for smart contracts and divided them into five impact levels. According to our classification, contract defects with seriousness level between 1-3 can lead to unwanted behaviors, e.g., a contract being controlled by attackers. In this paper, we propose DefectChecker, a symbolic execution-based approach and tool to detect eight contract defects that can cause unwanted behaviors of smart contracts on the Ethereum blockchain platform. DefectChecker can detect contract defects from smart contracts bytecode. We compare DefectChecker with key previous works, including Oyente, Mythril and Securify by using an open-source dataset. Our experimental results show that DefectChecker performs much better than these tools in terms of both speed and accuracy. We also applied DefectChecker to 165,621 distinct smart contracts on the Ethereum platform. We found that 25,815 of these smart contracts contain at least one of the contract defects that belongs to impact level 1-3, including some real-world attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
