SmartMemory：通过基于内存的智能体检测智能合约的链上-链下通信不一致问题
SmartMemory: Detecting On-chain-off-chain Communication Inconsistency for Smart Contract via Memory-based Agent
浏览论文内容
中文总结 AI 辅助
针对链上/链下通信（OFC）应用漏洞检测缺乏统一视角、易遗漏未知漏洞的问题，提出基于内存智能体的SmartMemory框架，通过语义映射、知识迁移与污点分析检测OFC不一致性，在自建数据集上取得80.68%精确率、87.65%召回率，还发现36个未知漏洞。
中文摘要 AI 辅助
智能合约是去中心化金融的基础，随着链上/链下通信（OFC）需求的不断增长，跨链桥、现实世界资产代币化、法币抵押稳定币等各类应用不断涌现。这类应用中与OFC相关的安全事件愈发频繁，但现有研究仅针对OFC应用中的单一漏洞类别展开，未提供统一的分析视角，导致已知模式之外的漏洞被遗漏。本文提出OFC不一致性（OFCI）是OFC漏洞的根本成因，其源于业务逻辑缺陷，最终会破坏链上与链下资产表示的等价性，引发不一致问题。自动检测OFCI面临两大挑战：一是定位异构业务逻辑，二是迁移现有漏洞知识以识别未见过的OFCI实例。\n为此，我们提出SmartMemory，这是首个利用基于内存的智能体实现OFCI检测的框架。为解决异构性问题，SmartMemory将OFC合约的多样化实现映射为规范的业务语义表示，从而定位用于OFCI检查的业务逻辑。为实现知识复用，SmartMemory集成了基于内存的智能体，可从特征中提炼漏洞知识，形成模式与检测规则，实现跨案例的知识迁移以识别未见过的OFCI。最后，SmartMemory执行污点分析，验证每个候选OFCI的可达性、类型及影响。我们构建了首个真实世界OFCI数据集，包含48个去中心化应用（DApp）与81个OFCI，用于评估。在该数据集上，SmartMemory的精确率达80.68%，召回率达87.65%。此外，通过对325个真实世界OFC应用的分析，SmartMemory检测出36个此前未知的OFCI，所有问题均已得到相关方确认并修复。
英文摘要
Smart contracts underpin decentralized finance, where growing demand for on-chain/off-chain communication(OFC) has driven diverse applications such as cross-chain bridges, real-world asset tokenization, and fiat-backed stablecoins. TheOFC-related security incidents in these applications are increasingly frequent, but prior studies address separate vulnerability categories within OFC applications rather than providing a unified view, causing vulnerabilities outside known patterns to be missed.In this paper, we identify OFC inconsistency (OFCI) as a root cause of OFC vulnerabilities, which arises from business-logic flaw and ultimately breaks the equivalence between the on-chain and off-chain asset representations to induce inconsistency.Automatically detecting OFCIs faces two challenges including (1)locating heterogeneous business logic, and (2) transferring existing vulnerability knowledge to identify unseen OFCI instances. To this end, we propose SmartMemory, the first framework to leverage a memory-based agent for OFCI detection. To address heterogeneity, SmartMemory maps diverse implementations ofOFC contracts into a canonical business-semantic representation to locate the business logic for OFCI inspection. For knowledge reuse, SmartMemory integrates a memory-based agent to distill vulnerability knowledge from features into patterns and detection rules, enabling knowledge transfer across cases to identify unseenOFCIs. Lastly, SmartMemory performs taint analysis to verify the reachability, type, and impact of each candidate OFCI. We construct the first real-world OFCI dataset comprising 48 DApps with 81 OFCIs for evaluation, on which SmartMemory achieves80.68% precision and 87.65% recall. In addition, through an analysis of 325 real-world OFC applications, SmartMemory detects 36 previously unknown OFCIs, all of which have been confirmed and fixed by corresponding parties.
发表机构
- Nanyang Technological University, Singapore（南洋理工大学）
- Sun Yat-sen University, China（中山大学）
机构由 AI 辅助整理，请以论文原文为准。
