English

应用科学学报 ›› 2024, Vol. 42 ›› Issue (2): 364-374.doi: 10.3969/j.issn.0255-8297.2024.02.016

• 计算机科学与应用 • 上一篇    

关键路径预搜索的符号执行智能合约漏洞检测

王泽旭1,2,3, 文斌1,3   

  1. 1. 海南师范大学 数据科学与智慧教育教育部重点实验室, 海南 海口 571158;
    2. 中山大学 软件工程学院, 广东 珠海 519082;
    3. 海南师范大学 信息科学技术学院, 海南 海口 571158
  • 收稿日期:2022-08-14 出版日期:2024-03-31 发布日期:2024-03-28
  • 通信作者: 文斌,教授,研究方向为区块链生态安全、数据安全。E-mail:binwen@hainnu.edu.cn E-mail:binwen@hainnu.edu.cn
  • 基金资助:
    国家自然科学基金（No.62362029）；海南省自然科学基金（No.623RC485）资助

Smart Contract Vulnerability Detection of Symbol Execution with Critical Path Pre-searching

WANG Zexu1,2,3, WEN Bin1,3   

  1. 1. Key Laboratory of Data Science and Smart Education, Ministry of Education, Hainan Normal University, Haikou 571158, Hainan, China;
    2. School of Software Engineering, Sun Yat-sen University, Zhuhai 519082, Guangdong, China;
    3. School of Information Science and Technology, Hainan Normal University, Haikou 571158, Hainan, China
  • Received:2022-08-14 Online:2024-03-31 Published:2024-03-28

PDF

9

摘要： 针对传统符号执行在不必要、不相关的路径上消耗大量时间与资源，效率低等问题，提出了利用静态检测预扫描智能合约关键路径优化符号执行验证，避免非必要路径搜索增加的资源消耗，实现基于关键路径预搜索的符号执行。该方法与现有主流检测工具进行对比实验，结果显示：Gas耗尽拒绝服务漏洞覆盖率达98%，检测准确度为84.3%，远高于均值37.2%；对存储覆盖漏洞合约的全覆盖，检测准确率为86.1%，验证了该方法的高效性与稳定性。

关键词: 智能合约, 漏洞检测, 符号执行, 关键路径预搜索, 区块链安全

Abstract: This paper proposes a pre-searching paths for symbolic execution method to guide the critical path symbol execution of scanning smart contract vulnerabilities through static detection. This approach aims to avoid unnecessary resource consumption of path search, thereby achieving accurate and fast smart contract vulnerability detection. This method is compared with existing mainstream detection tools. The results show that the Gas exhaustion denial of service vulnerability coverage reaches 98%, with a detection accuracy of 84.3%, which is far higher than the average value of 37.2%. Furthermore, the full coverage of storage coverage vulnerability contracts is realized with a detection accuracy of 86.1%, which validates the efficiency and stability of this method.

Key words: smart contract, vulnerability detection, symbol execution, pre-search of critical path, blockchain security

中图分类号: