智能合约安全漏洞挖掘技术研究

doi:10.11772/j.issn.1001-9081.2019010082

计算机应用 ›› 2019, Vol. 39 ›› Issue (7): 1959-1966.DOI: 10.11772/j.issn.1001-9081.2019010082

智能合约安全漏洞挖掘技术研究

付梦琳, 吴礼发, 洪征, 冯文博

中国解放军陆军工程大学指挥控制工程学院, 南京 210007

收稿日期:2019-01-14 修回日期:2019-03-13 出版日期:2019-07-10 发布日期:2019-04-15
通讯作者: 付梦琳
作者简介:付梦琳(1995-),女,江苏南京人,硕士研究生,主要研究方向:漏洞挖掘、区块链安全;吴礼发(1968-),男,湖北黄石人,教授,博士,CCF会员,主要研究方向:漏洞挖掘、网络管理;洪征(1979-),男,江苏南京人,副教授,博士,主要研究方向:协议逆向、漏洞挖掘;冯文博(1994-),男,河南郑州人,硕士研究生,主要研究方向:协议识别、机器学习。
基金资助:
国家重点研发计划项目（2017YFB0802900）。

Research on vulnerability mining technique for smart contracts

FU Menglin, WU Lifa, HONG Zheng, FENG Wenbo

College of Command and Control Engineering, the Army Engineering University of PLA, Nanjing Jiangsu 210007, China

Received:2019-01-14 Revised:2019-03-13 Online:2019-07-10 Published:2019-04-15
Supported by:
This work is partially supported by the National Key Research and Development Program of China (2017YFB0802900).

摘要/Abstract

摘要：

近年来，以智能合约为代表的第二代区块链平台及应用出现了爆发性的增长，但频发的智能合约漏洞事件严重威胁着区块链生态安全。针对当前主要依靠基于专家经验的代码审计效率低下的问题，提出开发通用的自动化工具来挖掘智能合约漏洞的重要性。首先，调研并分析了智能合约面临的安全威胁问题，总结了代码重入、访问控制、整数溢出等10种出现频率最高的智能合约漏洞类型和攻击方式；其次，讨论了主流的智能合约漏洞的检测手段，并梳理了智能合约漏洞检测的研究现状；然后，通过实验验证了3种现有符号执行工具的检测效果。对于单一漏洞类型，漏报率最高达0.48，误报率最高达0.38。实验结果表明，现有研究涵盖的漏洞类型不完整，误报及漏报多，并且依赖人工复核；最后，针对这些不足展望了未来研究方向，并提出一种符号执行辅助的模糊测试框架，能够缓解模糊测试代码覆盖率不足和符号执行路径爆炸问题，从而提高大中型规模智能合约的漏洞挖掘效率。

关键词: 区块链安全, 智能合约, 以太坊, 漏洞挖掘, 自动化工具

Abstract:

The second generation of blockchain represented by smart contract has experienced an explosive growth of its platforms and applications in recent years. However, frequent smart contract vulnerability incidents pose a serious risk to blockchain ecosystem security. Since code auditing based on expert experience is inefficient in smart contracts vulnerability mining, the significance of developing universal automated tools to mining smart contracts vulnerability was proposed. Firstly, the security threats faced by smart contracts were investigated and analyzed. Top 10 vulnerabilities, including code reentrancy, access control and integer overflow, as well as corresponding attack modes were summarized. Secondly, mainstream detection methods of smart contract vulnerabilities and related works were discussed. Thirdly, the performance of three existing tools based on symbolic execution were verified through experiments. For a single type of vulnerability, the highest false negative rate was 0.48 and the highest false positive rate was 0.38. The experimental results indicate that existing studies only support incomplete types of vulnerability with many false negatives and positives and depend on manual review. Finally, future research directions were forecasted aiming at these limitations, and a symbolic-execution-based fuzzy test framework was proposed. The framework can alleviate the problems of insufficient code coverage in fuzzy test and path explosion in symbolic execution, thus improving vulnerability mining efficiency for large and medium-sized smart contracts.

Key words: blockchain security, smart contract, Ethereum, vulnerability mining, automated tool

中图分类号:

付梦琳, 吴礼发, 洪征, 冯文博. 智能合约安全漏洞挖掘技术研究[J]. 计算机应用, 2019, 39(7): 1959-1966.

FU Menglin, WU Lifa, HONG Zheng, FENG Wenbo. Research on vulnerability mining technique for smart contracts[J]. Journal of Computer Applications, 2019, 39(7): 1959-1966.

参考文献

[1] 马昂,潘晓,吴雷,等.区块链技术基础及应用研究综述[J].信息安全研究,2017,3(11):968-983.(MA A, PAN X, WU L, et al. A survey of the basic technology and application of block chain[J]. Journal of Information Security Research, 2017, 3(11):968-983.)
[2] BUTERIN V. Ethereum:a next-generation smart contract and decentralized application platform[EB/OL]. (2014-01-23)[2018-09-08]. https://bitcoinmagazine.com/articles/ethereum-next-generation-cryptocurrency-decentralized-application-platform-1390528211/.
[3] 长铗,韩锋,杨涛.区块链:从数字货币到信用社会[M].北京:中信出版社,2016:62-73.(CHANG J, HAN F, YANG T. Blockchain:From Digital Currency to Credit Society[M]. Beijing:China CITIC Press, 2016:62-73.)
[4] NCC Group. Decentralized application security project top 10 of 2018[EB/OL]. (2018-07-08)[2018-09-08]. https://www.dasp.co/index.html.
[5] SECBIT. Frequent smart contracts events, security development requires standardization[EB/OL]. (2018-05-07)[2018-10-20]. https://www.jianshu.com/p/9d78f5110af1.
[6] MANNING A. Solidity security:comprehensive list of known attack vectors and common anti-patterns[EB/OL]. (2018-05-30)[2019-01-03]. https://blog.sigmapri-me.io/solidity-security.html.
[7] ARIAS L, SPAGNUOLO F, GIORDANO F, et al. OpenZeppelin[EB/OL]. (2016-07-31)[2018-12-06]. https://github.com/OpenZeppelin/openzeppelin-Solidity.
[8] ATZEI N, BARTOLETTI M, CIMOLI T. A survey of attacks on Ethereum smart contracts (SoK)[C]//Proceedings of the 2017 International Conference on Principles of Security and Trust. Berlin:Springer, 2017:164-186.
[9] FEY G. Assessing system vulnerability using formal verification techniques[C]//Proceedings of the 2011 International Conference on Mathematical and Engineering Methods in Computer Science. Berlin:Springer, 2011:47-56.
[10] CSDN Research and Development Technology. Formal verification is a sharp weapon for smart contracts safety[EB/OL]. (2018-06-12)[2018-09-08]. https://blog.csdn.net/CDLianan/article/details/80665163.
[11] Certik.用形式化验证的方式构建安全的智能合约和区块链生态系统[EB/OL].(2018-07-11)[2019-01-06]. https://baijiahao.baidu.com/s?id=1605131670683321304&wfr=spider&for=pc.(Certik:Constructing secure smart contract and block chain ecosystem by formal verification[EB/OL]. (2018-07-11)[2019-01-06].https://baijiahao.baidu.com/s?id=1605131670683321304&wfr=spider&for=pc.)
[12] BHARGAVAN K, SWAMY N, ZANELLA B S, et al. Formal verification of smart contracts:short paper[C]//Proceedings of the 2016 Association for Computing Machinery Workshop. New York:ACM, 2016:91-96.
[13] YANG X, YANG Z, SUN H Y, et al. Formal verification for Ethereum smart contract using Coq[J]. International Journal of Information and Communication Engineering, 2018, 12(6):125-130.
[14] HIRAI Y. pirapira/eth-isabelle[EB/OL]. (2016-04-24)[2018-12-18]. https://github.com/pirapira/eth-isabelle.
[15] MARCHE C, MELQUIOND G, FILLIATRE J C, et al. AdaCore/why3[EB/OL]. (2009-11-29)[2018-12-18]. https://github.com/AdaCore/why3.
[16] BEKRAR S, BEKRAR C, GROZ R, et al. Finding software vulnerabilities by smart fuzzing[C]//Proceedings of the 4th International Conference on Software Testing, Verification and Validation. Piscataway, NJ:IEEE, 2011:427-430.
[17] SMITH J P, PEREZ B, CHRISTIE C, et al. Trailofbits/echidna[EB/OL].(2018-06-12)[2018-09-08]. https://github.com/trailofbits/echidna.
[18] JIANG B, LI Y, CHAN W K. ContractFuzzer:fuzzing smart contracts for vulnerability detection[C]//Proceedings of the 33rd IEEE/ACM International Conference on Automated Software Engineering. New York:ASE, 2018:259-268.
[19] 吴世忠,郭涛,董国伟.软件漏洞分析技术[M].北京:科学出版社,2014:215-268.(WU S Z, GUO T, DONG G W. Software Vulnerability Analysis Technology[M]. Beijing:Science Press, 2014:215-268.)
[20] LUU L, CHU D H, OLICKEL H, et al. Making smart contracts smarter[C]//Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM, 2016:254-269.
[21] MOSSBERG M, IVNITSKIY Y, SMITH J P, et al. trailofbits/manticore[EB/OL]. (2017-02-12)[2018-09-08]. https://github.com/trailofbits/manticore.
[22] NIKOLIC I, KOLLURI A, SERGEY I, et al. Finding the greedy, prodigal, and suicidal contracts at scale[EB/OL]. (2018-02-06)[2018-11-14]. https://arxiv.org/pdf/1802.06038.pdf.
[23] TSANKOV P, DAN A, COHEN D D. Securify:practical security analysis of smart contracts[C]//Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM, 2018:67-82.
[24] KRUPP J, ROSSOW C. teEther:gnawing at Ethereum to automatically exploit smart contracts[C]//Proceedings of the 27th USENIX Security Symposium. Berkeley, CA:USENIX Association, 2018:1317-1333.
[25] MUELLER B, HONIG J, PARASARAM N, et al. ConsenSys/mythril[EB/OL]. (2017-09-17)[2018-12-04]. https://github.com/ConsenSys/mythril.

智能合约安全漏洞挖掘技术研究

Research on vulnerability mining technique for smart contracts

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	申玉民, 王金龙, 胡殿凯, 刘星宇. 基于区块链的建筑信息模型图纸多人协同创作系统[J]. 计算机应用, 2021, 41(8): 2338-2345.
[2]	陈葳葳, 曹利, 顾翔. 基于区块链的车联网电子取证模型[J]. 计算机应用, 2021, 41(7): 1989-1995.
[3]	李蓓, 张问银, 王九如, 赵伟, 王海峰. 基于区块链的密封式投标拍卖方案[J]. 计算机应用, 2021, 41(4): 999-1004.
[4]	张国潮, 唐华云, 陈建海, 沈睿, 何钦铭, 黄步添. 基于区块链的数字音乐版权管理系统[J]. 计算机应用, 2021, 41(4): 945-955.
[5]	包玉龙, 朱雪阳, 张文辉, 孙鹏飞, 赵颖琪. 物联网应用中访问控制智能合约的形式化验证[J]. 计算机应用, 2021, 41(4): 930-938.
[6]	庞晓琼, 杨婷, 陈文俊, 王云婷, 刘天野. 区块链环境下基于秘密共享的数字权限管理方案[J]. 《计算机应用》唯一官方网站, 2021, 41(11): 3257-3265.
[7]	吴芷菡, 崔喆, 刘霆, 蒲泓全. 基于区块链的安全电子选举方案[J]. 计算机应用, 2020, 40(7): 1989-1995.
[8]	王海勇, 潘启青, 郭凯璇. 基于区块链和用户信用度的访问控制模型[J]. 计算机应用, 2020, 40(6): 1674-1679.
[9]	谭文安, 王慧. 基于智能合约的可信筹款捐助方案与平台[J]. 计算机应用, 2020, 40(5): 1483-1487.
[10]	赵伟, 张问银, 王九如, 王海峰, 武传坤. 基于符号执行的智能合约漏洞检测方案[J]. 计算机应用, 2020, 40(4): 947-953.
[11]	吴雨芯, 蔡婷, 张大斌. 基于层级注意力机制与双向长短期记忆神经网络的智能合约自动分类模型[J]. 计算机应用, 2020, 40(4): 978-984.
[12]	拜亚萌, 满君丰, 张宏. 基于区块链的电子健康记录安全存储模型[J]. 计算机应用, 2020, 40(4): 961-965.
[13]	韩妍妍, 张齐, 闫晓璇, 刘培鹤, 徐鹏格. 基于区块链的电子文件流转设计与实现[J]. 计算机应用, 2020, 40(11): 3357-3365.
[14]	陈葳葳, 曹利, 邵长虹. 基于区块链技术的车联网高效匿名认证方案[J]. 计算机应用, 2020, 40(10): 2992-2999.
[15]	任玉柱, 张有为, 艾成炜. 污点分析技术研究综述[J]. 计算机应用, 2019, 39(8): 2302-2309.