VOLCANO：使用代码克隆分析检测以太坊智能合约的漏洞
VOLCANO: Detecting Vulnerabilities of Ethereum Smart Contracts Using Code Clone Analysis
摘要：
基于区块链技术（BT）的以太坊智能合约使区块链网络上的同行之间的货币交易独立于中央授权机构。以太坊智能合约是部署为去中心化应用程序的程序，具有区块链共识协议的构建块。这使消费者能够在透明和无冲突的环境中达成协议。然而，这些智能合约中存在一些安全漏洞，对应用程序及其消费者构成潜在威胁，并在过去造成了巨大的经济损失。本文提出了一个框架和实证分析，使用代码克隆检测技术来识别智能合约中的漏洞及其变化。我们的实证分析是使用Nicad代码克隆检测工具在大约5万个以太坊智能合约的数据集上进行的。我们在两个数据集上评估了VOLCANO，一个数据集具有已确认的漏洞，另一个数据集具有从Etherscan收集的大约50k个随机智能合约。与两种公开可用的静态分析器检测智能合约中的漏洞相比，我们的方法在覆盖率和效率方面都有所改进。据我们所知，这是第一项使用克隆检测技术来识别以太坊智能合约中的漏洞及其演变的研究。
英文摘要：
Ethereum Smart Contracts based on Blockchain Technology (BT) enables monetary transactions among peers on a blockchain network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This enables consumers to make agreements in a transparent and conflict-free environment. However, there exist some security vulnerabilities within these smart contracts that are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. This paper presents a framework and empirical analysis that use code clone detection techniques for identifying vulnerabilities and their variations in smart contracts. Our empirical analysis is conducted using the Nicad code clone detection tool on a dataset of approximately 50k Ethereum smart contracts. We evaluated VOLCANO on two datasets, one with confirmed vulnerabilities and another with approximately 50k random smart contracts collected from the Etherscan. Our approach shows an improvement in the detection of vulnerabilities in terms of coverage and efficiency when compared to two of the publicly available static analyzers to detect vulnerabilities in smart contracts. To the best of our knowledge, this is the first study that uses a clone detection technique to identify vulnerabilities and their evolution in Ethereum smart contracts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
