计算机科学 ›› 2026, Vol. 53 ›› Issue (7): 422-432.doi: 10.11896/jsjkx.250500008
陈珊珊, 荆宁康
CHEN Shanshan, JING Ningkang
摘要： 近年来,以太坊智能合约引起了广泛关注,但其中存在的安全漏洞可能导致巨大的经济损失,这凸显了漏洞检测与修复的重要性。然而,当前的研究主要集中在漏洞检测上,对于有效的修复工具关注较少,这将导致高昂的人工修复成本。为了解决这一问题,提出了一个集漏洞检测与修复于一体的新型框架OptimalFix,它能够自动为不安全的智能合约生成安全补丁。OptimalFix首先将智能合约转换为中间表示形式,并利用静态检测技术快速识别和定位漏洞。随后,系统执行静态程序分析,包括误报过滤和程序依赖分析等操作。在此基础上,框架通过模板化方法生成补丁,并根据前期静态分析(包括检测结果与程序分析)选择最优的修复模板。在3个数据集上对OptimalFix进行了评估,结果表明系统能够成功修复90.2%的漏洞,平均补丁生成时间仅为900 ms,同时合约的Gas消耗仅增加了6.7%。
中图分类号:
| [1]SANTOS F,KOSTAKIS V.The DAO:a million dollar lesson in blockchain governance[EB/OL].http://technologygovernance.eu/eng/defended_theses/francisco_santos/. [2]TIKHOMIROV S,VOSKRESENSKAYA E,IVANITSKIY I,et al.Smartcheck:Static analysis of ethereum smart contracts[C]//Proceedings of the 1st International Workshop on Emerging Trends in Software Engineering for Blockchain.2018:9-16. [3]CHEN Q S,HE X Y,XU W J,et al.Reentrancy Vulnerability Detection Based on Pre-training Technology and Expert Know-ledge[J].Computer Science,2022,49(11A):713-720. [4]KALRA S,GOEL S,DHAWAN M,et al.Zeus:analyzing safety of smart contracts[C]//Ndss.2018:1-12. [5]FEIST J,GRIECO G,GROCE A.Slither:a static analysisframework for smart contracts[C]//2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain(WETSEB).IEEE,2019:8-15. [6]CHEN Y,DAI H,YU X,et al.Improving Ponzi scheme contract detection using multi-channel TextCNN and transformer[J].Sensors,2021,21(19):6417. [7]ASSIRI F Y,BIEMAN J M.The impact of search algorithms in automated program repair[J].Procedia Computer Science,2015,62:65-72. [8]YUSTE J,DUARTE A,PARDO E G.An efficient heuristic algorithm for software module clustering optimization[J].Journal of Systems and Software,2022,190:111349. [9]NGUYEN T D,PHAM L H,SUN J.SGUARD:towards fixing vulnerable smart contracts automatically[C]//2021 IEEE Symposium on Security and Privacy(SP).IEEE,2021:1215-1229. [10]RODLER M,LI W,KARAME G O,et al.{EVMPatch}:Timely and automated patching of ethereum smart contracts[C]//30th Usenix Security Symposium(USENIX Security 21).2021:1289-1306. [11]CHEN Q,ZHOU T,LIU K,et al.Tips:towards automatingpatch suggestion for vulnerable smart contracts[J].Automated Software Engineering,2023,30(2):31. [12]DURIEUX T,FERREIRA J F,ABREU R,et al.Empirical review of automated analysis tools on 47,587 ethereum smart contracts[C]//Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering.2020:530-541. [13]ZHANG P C,XIAO F,LUO X P.A framework and dataset for bugs in ethereum smart contracts[C]//2020 IEEE International Conference on Software Maintenance and Evolution(ICSME).IEEE,2020:139-150. [14]GHALEB A,PATTABIRAMAN K.How effective are smartcontract analysis tools? evaluating smart contract static analysis tools using bug injection[C]//Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis.2020:415-427. [15]LUU L,CHU D H,OLICKEL H,et al.Making smart contracts smarter[C]//Proceedings of the 2016 ACM SIGSAC Confe-rence on Computer and Communications Security(CCS).2016:254-269. [16]AMRI S A L,ANIELLO L,SASSONE V.A review of upgradeable smart contract patterns based on openzeppelin technique[J].The Journal of The British Blockchain Association,2023,6(1):1-8. [17]MENSE A,FLATSCHER M.Security vulnerabilities in ethe-reum smart contracts[C]//Proceedings of the 20th International Conference on Information Integration and Web-based Applications & Services.2018:375-380. [18]LIU K,LI L,KOYUNCU A,et al.A critical review on the eva-luation of automated program repair systems[J].Journal of Systems and Software,2021,171:110817. [19]WOOD G.Ethereum:A secure decentralised generalised transaction ledger[J].Ethereum project yellow paper,2014,151:1-32. [20]LIU K,XU T T.Survey on automated vulnerability repair[J].Journal of Software,2023:35(1):136-158. [21]LIU K,LI L,KOYUNCU A,et al.A critical review on the eva-luation of automated program repair systems[J].Journal of Systems and Software,2021,171:110817. [22]LIU K,KOYUNCU A,KIM D,et al.TBar:Revisiting template-based automated program repair[C]//Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis.2019:31-42. [23]LU N,WANG B,ZHANG Y,et al.NeuCheck:A more practical Ethereum smart contract security analysis tool[J].Software:Practice and Experience,2021,51(10):2065-2084. [24]ZHAN P,XIAO F,LUO X.A framework and dataset for bugs in ethereum smart contracts[C]//2020 IEEE International Conference on Software Maintenance and Evolution(ICSME).IEEE,2020:139-150. [25]FANG P,GAO P,PENG Y,et al.Contractfix:A framework for automatically fixing vulnerabilities in smart contracts[J].arXiv:2307.08912,2023. [26]CLARK J,DEROSE S.XML path language(XPath)[EB/OL].(1999-11-16).https://www.renderx.com/~renderx/portal/Tests/xmlspec/xpath.pdf [27]PARR T.The definitive ANTLR 4 reference[M].PRAGMATIC BOOKSHELF,2013. [28]LIU K,KOYUNCU A,KIM D,et al.TBar:Revisiting template-based automated program repair[C]//Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis.2019:31-42. [29]DIMITRIJEVIC' N,ZDRAVKOVIC'N.A review on security vulnerabilities of smart contracts written in solidity[EB/OL].https://www.eventiotic.com/eventiotic/files/Papers/URL/6d46e328-e12b-44e7-9005-839f3b5cf7cd.pdf. [30]CHEN H,LUO X,SHI L,et al.Security challenges and defense approaches for blockchain-based services from a full-stack architecture perspective[J].Blockchain:Research and Applications,2023,4(3):100135. [31]CHEN T,LI X,LUO X,et al.Under-optimized smart contracts devour your money[C]//2017 IEEE 24th International Conference on Software Analysis,Evolution and Reengineering(SANER).IEEE,2017:442-446. [32]NAVAS E.Remix theory:The aesthetics of sampling[M].Birkhäuser,2014. |
|
||
首页