智能合约安全漏洞挖掘技术研究

近年来,以智能合约为代表的第二代区块链平台及应用出现了爆发性的增长,但频发的智能合约漏洞事件严重威胁着区块链生态安全。针对当前主要依靠基于专家经验的代码审计效率低下的问题,提出开发通用的自动化工具来挖掘智能合约漏洞的重要性。首先,调研并分析了智能合约面临的安全威胁问题,总结了代码重入、访问控制、整数溢出等10种出现频率最高的智能合约漏洞类型和攻击方式;其次,讨论了主流的智能合约漏洞的检测手段,并梳理了智能合约漏洞检测的研究现状;然后,通过实验验证了3种现有符号执行工具的检测效果。对于单一漏洞类型,漏报率最高达0.48,误报率最高达0.38。实验结果表明,现有研究涵盖的漏洞类型不完整,误报及漏报多,并且依赖人工复核;最后,针对这些不足展望了未来研究方向,并提出一种符号执行辅助的模糊测试框架,能够缓解模糊测试代码覆盖率不足和符号执行路径爆炸问题,从而提高大中型规模智能合约的漏洞挖掘效率。

Research on vulnerability mining technique for smart contracts

The second generation of blockchain represented by smart contract has experienced an explosive growth of its platforms and applications in recent years. However, frequent smart contract vulnerability incidents pose a serious risk to blockchain ecosystem security. Since code auditing based on expert experience is inefficient in smart contracts vulnerability mining, the significance of developing universal automated tools to mining smart contracts vulnerability was proposed. Firstly, the security threats faced by smart contracts were investigated and analyzed. Top 10 vulnerabilities, including code reentrancy, access control and integer overflow, as well as corresponding attack modes were summarized. Secondly, mainstream detection methods of smart contract vulnerabilities and related works were discussed. Thirdly, the performance of three existing tools based on symbolic execution were verified through experiments. For a single type of vulnerability, the highest false negative rate was 0.48 and the highest false positive rate was 0.38. The experimental results indicate that existing studies only support incomplete types of vulnerability with many false negatives and positives and depend on manual review. Finally, future research directions were forecasted aiming at these limitations, and a symbolic-execution-based fuzzy test framework was proposed. The framework can alleviate the problems of insufficient code coverage in fuzzy test and path explosion in symbolic execution, thus improving vulnerability mining efficiency for large and medium-sized smart contracts.