HCC：一种面向智能合约的语言无关加固合约编译器
HCC: A Language-Independent Hardening Contract Compiler for Smart Contracts
AI总结：
本文提出语言无关的编译器 HCC，利用代码属性图在源码层自动插入安全检查，可防御六类常见智能合约漏洞，并在大规模真实合约上验证其实用性与防护效果。
摘要：
开发安全的智能合约仍然是一项具有挑战性的任务。现有方法要么不切实际，要么将修复漏洞的负担留给开发者。本文提出首个实用的智能合约编译器 HCC，它基于一种新颖且语言无关的代码属性图（CPG）表示，在源代码层面自动插入安全加固检查。所开发 CPG 的高表达能力使我们能够缓解所有最常见的智能合约漏洞，即重入、整数错误、可自杀智能合约、不当使用 tx.origin、不可信 delegate-call 以及未经检查的低级调用错误。我们对 1 万个真实合约以及来自相关工作的多组易受攻击合约进行大规模评估，结果表明 HCC 具有高度实用性，优于最先进的合约加固技术，并在不影响功能正确性的情况下有效阻止所有已验证的攻击交易。
英文摘要：
Developing secure smart contracts remains a challenging task. Existing approaches are either impractical or leave the burden to developers for fixing bugs. In this paper, we propose the first practical smart contract compiler, called HCC, which automatically inserts security hardening checks at the source-code level based on a novel and language-independent code property graph (CPG) notation. The high expressiveness of our developed CPG allows us to mitigate all of the most common smart contract vulnerabilities, namely reentrancy, integer bugs, suicidal smart contracts, improper use of tx.origin, untrusted delegate-calls, and unchecked low-level call bugs. Our large-scale evaluation on 10k real-world contracts and several sets of vulnerable contracts from related work demonstrates that HCC is highly practical, outperforms state-of-the-art contract hardening techniques, and effectively prevents all verified attack transactions without hampering functional correctness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
