arXiv 2402.090942024-02-15cs.CRcs.SE

团结就是力量：增强智能合约分析工具中重入漏洞检测的精确度

Unity is Strength: Enhancing Precision in Reentrancy Vulnerability Detection of Smart Contract Analysis Tools

Zexu Wang, Jiachi Chen, Zibin Zheng, Peilin Zheng, Yu Zhang, Weizhe Zhang

AI总结：

针对智能合约重入漏洞检测工具误报率高且难以适应新攻击模式的问题，提出名为 ReEP 的工具，通过集成和评估多个现有检测工具来验证漏洞并减少误报，将八种工具的平均精确度从0.5%提升至73%，集成后最高达83.6%。

摘要：

重入是智能合约中最臭名昭著的漏洞之一，导致了严重的数字资产损失。然而，许多先前的研究表明，当前的重入检测工具存在高误报率的问题。更糟糕的是，近年来在复杂多样的漏洞利用机制的推动下，出现了新的重入攻击模式。不幸的是，当前工具在适应和检测这些不断演变的重入模式的能力方面面临重大限制。因此，确保精确且高度可扩展的重入漏洞检测仍然是现有工具面临的关键挑战。为了解决这个问题，我们提出了一种名为 ReEP 的工具，旨在降低重入漏洞检测的误报率。此外，ReEP 可以集成多个工具，扩展其漏洞检测能力。它评估现有工具的结果以验证漏洞可能性并减少误报。ReEP 还提供了出色的可扩展性，能够集成不同的检测工具以提高精确度并覆盖不同的漏洞攻击模式。我们将 ReEP 应用于八种现有的最先进的重入检测工具。在不牺牲召回率的情况下，这八种工具的平均精确度从最初的 0.5% 提高到了 73%。此外，ReEP 展现出强大的可扩展性。通过集成多个工具，精确度进一步提高到最高 83.6%。这些结果表明，ReEP 有效地结合了现有工作的优势，提高了重入漏洞检测工具的精确度。

英文摘要：

Reentrancy is one of the most notorious vulnerabilities in smart contracts, resulting in significant digital asset losses. However, many previous works indicate that current Reentrancy detection tools suffer from high false positive rates. Even worse, recent years have witnessed the emergence of new Reentrancy attack patterns fueled by intricate and diverse vulnerability exploit mechanisms. Unfortunately, current tools face a significant limitation in their capacity to adapt and detect these evolving Reentrancy patterns. Consequently, ensuring precise and highly extensible Reentrancy vulnerability detection remains critical challenges for existing tools. To address this issue, we propose a tool named ReEP, designed to reduce the false positives for Reentrancy vulnerability detection. Additionally, ReEP can integrate multiple tools, expanding its capacity for vulnerability detection. It evaluates results from existing tools to verify vulnerability likelihood and reduce false positives. ReEP also offers excellent extensibility, enabling the integration of different detection tools to enhance precision and cover different vulnerability attack patterns. We perform ReEP to eight existing state-of-the-art Reentrancy detection tools. The average precision of these eight tools increased from the original 0.5% to 73% without sacrificing recall. Furthermore, ReEP exhibits robust extensibility. By integrating multiple tools, the precision further improved to a maximum of 83.6%. These results demonstrate that ReEP effectively unites the strengths of existing works, enhances the precision of Reentrancy vulnerability detection tools.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

AI总结：

摘要：

英文摘要：

相关论文