SlightDetection：一种以太坊智能合约安全漏洞的静态分析工具

doi:10.3969/j.issn.0255-8297.2022.04.012

应用科学学报 ›› 2022, Vol. 40 ›› Issue (4): 695-712.doi: 10.3969/j.issn.0255-8297.2022.04.012

• 区块链 • 上一篇

SlightDetection：一种以太坊智能合约安全漏洞的静态分析工具

陈霄汉¹, 赵相福¹, 张登记², 费佳佳¹

1. 烟台大学计算机与控制工程学院, 山东烟台 264005;
2. 浙江师范大学数学与计算机科学学院, 浙江金华 321004

收稿日期:2021-11-12 发布日期:2022-08-03
通信作者: 赵相福，教授，研究方向为区块链、人工智能。E-mail:xiangfuzhao@gmail.com E-mail:xiangfuzhao@gmail.com
基金资助:
国家自然科学基金（No.61972360,No.62072392）资助

SlightDetection: A Static Analysis Tool for Smart Contracts Security Vulnerabilities on Ethereum

CHEN Xiaohan¹, ZHAO Xiangfu¹, ZHANG Dengji², FEI Jiajia¹

1. School of Computer and Control Engineering, Yantai University, Yantai 264005, Shandong, China;
2. School of Mathematics and Computer Science, Zhejiang Normal University, Jinhua 321004, Zhejiang, China

Received:2021-11-12 Published:2022-08-03

摘要/Abstract

摘要： 以太坊智能合约若存在安全漏洞，则会导致无可估量的损失。为缓解该问题，提出了一种以静态程序分析技术实现代码全覆盖的智能合约漏洞检测工具SlightDetection。该工具将智能合约源代码转化为对应的抽象语法树，并翻译为XML中间表示；以几个经典漏洞的特征为例，书写自定义的XPath规则库；将XML中间表示与XPath库作为输入不断遍历XPath规则库并进行匹配，最终得到漏洞检测的报告。该文测试了3个经典合约，充分展示了SlightDetection具有更快、更准确的检测特性；对Etherscan上提供的大量智能合约进行测试并对其中100多份合约进行了手动验证，进一步证明了该工具的有效性。

关键词: 智能合约, 漏洞检测, 静态分析, 以太坊

Abstract: Security vulnerabilities in Ethereum smart contracts may lead to immeasurable losses. To alleviate this problem, a smart contract vulnerability detection tool SlightDetection is proposed, which uses static program analysis technology to achieve full code coverage. The tool converts smart contract source codes into a corresponding abstract syntax tree, and translates it into an XML intermediate representation. Taking the characteristics of several classic vulnerabilities as an example, the tool writes a custom XPath rule library, and using the XML intermediate representation and the XPath library as inputs, the tool keeps traversing and matching the XPath rule base, till getting the report of vulnerability detection. This work tests 3 classic contracts, and fully demonstrates the faster and more accurate detection features of SlightDetection. The effectiveness of the tool is proved by testing a large number of smart contracts provided on Etherscan and manually verifying more than 100 of them.

Key words: smart contract, vulnerability detection, static analysis, Ethereum

中图分类号:

TP311

陈霄汉, 赵相福, 张登记, 费佳佳. SlightDetection：一种以太坊智能合约安全漏洞的静态分析工具[J]. 应用科学学报, 2022, 40(4): 695-712.

CHEN Xiaohan, ZHAO Xiangfu, ZHANG Dengji, FEI Jiajia. SlightDetection: A Static Analysis Tool for Smart Contracts Security Vulnerabilities on Ethereum[J]. Journal of Applied Sciences, 2022, 40(4): 695-712.

参考文献

[1] Nakamoto S.Bitcoin:a peer-to-peer electronic cash system[R/OL].(2008-10-31)[2021-08-10].https://www.debr.io/article/21260-bitcoin-a-peer-to-peer-electronic-cash-system.
[2] 邵奇峰,金澈清,张召,等.区块链技术:架构及进展[J].计算机学报, 2018, 41(5):969-988.Shao Q F, Jin C Q, Zhang Z, et al.Blockchain:architecture and research progress[J].Chinese Journal of Computers, 2018, 41(5):969-988.(in Chinese)
[3] Buterin V.A next-generation smart contract and decentralized application platform[R/OL].(2013-12-31)[2021-08-10].https://ethereum.org/en/whitepaper/.
[4] 陈伟利,郑子彬.区块链数据分析:现状、趋势与挑战[J].计算机研究与发展, 2018, 55(9):1853-1870.Chen W L, Zheng Z B.Blockchain data analysis:a review of status, trend and challenges[J].Journal of Computer Research and Development, 2018, 55(9):1853-1870.(in Chinese)
[5] 张亮,刘百祥,张如意.区块链技术综述[J].计算机工程, 2019, 45(5):1-12.Zhang L, Liu B X, Zhang R Y.Overview of blockchain technology[J].Computer Engineering, 2019, 45(5):1-12.(in Chinese)
[6] 袁勇,王飞跃.区块链技术发展现状与展望[J].自动化学报, 2016, 42(4):481-494.Yuan Y, Wang F Y.Blockchain:the state of the art and future trends[J].Acta Automatica Sinica, 2016, 42(4):481-494.(in Chinese)
[7] Atzei N, Bartoletti M, Cimoli T.A survey of attacks on Ethereum smart contracts (SoK)[C]//International Conference on Principles of Security&Trust.Berlin Heidelberg:Springer, 2017:164-186.
[8] 倪远东,张超,殷婷婷.智能合约安全漏洞研究综述[J].信息安全学报, 2020, 5(3):78-99.Ni Y D, Zhang C, Yin T T.A survey of smart contract vulnerability research[J].Journal of Cyber Security, 2020, 5(3):78-99.(in Chinese)
[9] Buterin V.Critical update Re:DAO vulnerability Ethereum blog[EB/OL].(2016-06-17)[2021-08-10].https://blog.ethereum.org/2016/06/17/critical-update-re-dao-vulnerability/.
[10] 张登记,赵相福,陈中育,等.基于Ethereum智能合约的安全策略分析[J].应用科学学报, 2021, 39(1):151-163.Zhang D J, Zhao X F, Chen Z Y, et al.Analysis of security strategies for smart contract based on Ethereum[J].Journal of Applied Sciences, 2021, 39(1):151-163.(in Chinese)
[11] Hessenauer M S.Batch overflow bug on Ethereum ERC20 token contracts[EB/OL].(2017-06-30)[2021-08-10].https://blog.matryx.ai/batch-over-flow-bug-on-ethereum-erc20-tokencontracts-and-safemath-f9ebcc.
[12] 刘汉卿,阮娜.区块链中攻击方式的研究[J].计算机学报, 2021, 44(4):786-805.Liu H Q, Ruan N.A survey on attacking strategies in blockchain[J].Chinese Journal of Computers, 2021, 44(4):786-805.(in Chinese).
[13] 任艳丽,徐丹婷,张新鹏.可修改的区块链方案[J].软件学报, 2020, 31(12):3909-3922.Ren Y L, Xu D T, Zhang X P.Scheme of revisable blockchain[J].Journal of Software, 2020, 31(12):3909-3922.
[14] Luu L, Chu D H, Olickel H, et al.Making smart contracts smarter[C]//Proceedings of ACM SIGSAC Conference on Computer and Communications Security, 2016:254-269.
[15] Husikyan L, Guezengar F.Remix-IDE layout[EB/OL].2016[2021-08-10].https://remixide.readthedocs.io/en/latest/layout.html.
[16] Tikhomirov S, Voskresenskaya E, Ivanitskiy I, et al.Smartcheck:static analysis of Ethereum smart contracts[C]//Proceedings of the 1st International Workshop on Emerging Trends in Software Engineering for Blockchain, 2018:9-16.
[17] Gao J, Han L, Chao L, et al.EASYFLOW:keep Ethereum away from overflow[C]//IEEE/ACM 41st International Conference on Software Engineering:Companion Proceedings, 2019:23-26.
[18] Reitwiessner C, Wood G, Beregszaszi A, et al.Solidity[EB/OL].2017[2021-08-10].https://solidity.readthedocs.org.
[19] Terence P.ANTLR[EB/OL].(2013-04-30)[2021-08-10].http://www.antlr.org/.
[20] Robie J, Dyck M, Spiegel J.XML path language (XPath)3.1[EB/OL].2014[2021-08-10].https://www.w3.org/TR/xpath-3/.
[21] Tan M, Chuan W, Paulin, et al.Etherscan is the blockchain explorer for Ethereum[EB/OL].2016[2021-08-10].https://cn.etherscan.com/.
[22] Wagner G.Verified contracts synced from Etherscan[EB/OL].(2021-04-30)[2021-08-10].https://github.com/thec00n/etherscan verified contracts.

SlightDetection：一种以太坊智能合约安全漏洞的静态分析工具

SlightDetection: A Static Analysis Tool for Smart Contracts Security Vulnerabilities on Ethereum

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 10

编辑推荐

Metrics

本文评价

[1]	吴欧, 张贺, 王岩泽, 李昊明, 李杉杉. 异构多链场景下跨境海产品供应链平台的架构设计与实现[J]. 应用科学学报, 2022, 40(4): 539-554.
[2]	朱自强, 姚中原, 祝卫华, 赵海鸿, 潘长风, 斯雪明. 匿名可追溯的区块链数据交易方案[J]. 应用科学学报, 2022, 40(4): 653-665.
[3]	王诚, 郑红, 黄建华, 钱诗慧. 基于双区块链的PKI模型[J]. 应用科学学报, 2022, 40(3): 528-538.
[4]	赵颖琪, 朱雪阳, 李广元, 高雅, 包玉龙. 带时间约束的智能合约验证[J]. 应用科学学报, 2021, 39(1): 1-16.
[5]	王思源, 邹仕洪. 多域物联网中基于区块链和权能的访问控制机制[J]. 应用科学学报, 2021, 39(1): 55-69.
[6]	向伟静, 蔡维德. 法律智能合约平台模型的研究与设计[J]. 应用科学学报, 2021, 39(1): 109-122.
[7]	周正强, 陈玉玲, 李涛, 任晓军, 卿欣艺. 基于联盟链的医疗数据安全共享方案[J]. 应用科学学报, 2021, 39(1): 123-134.
[8]	张登记, 赵相福, 陈中育, 童向荣. 基于Ethereum智能合约的安全策略分析[J]. 应用科学学报, 2021, 39(1): 151-163.
[9]	何正源, 段田田, 张颖, 张瀚文, 孙毅. 物联网中区块链技术的应用与挑战[J]. 应用科学学报, 2020, 38(1): 22-33.
[10]	苑陈娟, 孙国梓, 李华康, 王纪涛. 牌类游戏可信存证链系统[J]. 应用科学学报, 2020, 38(1): 81-92.