论文标题
智能合同分析工具的有效性如何？使用错误注入评估智能合约静态分析工具
How Effective are Smart Contract Analysis Tools? Evaluating Smart Contract Static Analysis Tools Using Bug Injection
论文作者
论文摘要
针对智能合同的安全攻击一直在上升，这导致了经济损失和信任的侵蚀。因此，重要的是要使开发人员在部署前发现智能合约中的安全漏洞。已经开发了许多用于在智能合约中查找安全错误的静态分析工具。但是，尽管有许多错误调查工具，但没有系统的方法来评估所提出的工具并评估其有效性。本文提出了Solidifi，这是一种评估智能合约静态分析工具的自动化和系统的方法。 Solidifi基于将错误（即代码缺陷）注射到智能合约中所有潜在位置，以引入目标安全漏洞。然后，Solidifi使用静态分析工具检查生成的错误合同，并确定这些工具无法检测到的错误（false-congivations），同时识别报告为虚假启动的错误。 Solidifi用于评估六种广泛使用的静态分析工具，即使用9369个不同的错误注入的50个合同，即Oyente，Oyente，Searify，MyThril，Smartcheck，Manticore和Slither。它发现了几个错误的实例，这些错误尽管声称能够检测到此类错误，但这些错误未检测到，所有工具都报告了许多误报
Security attacks targeting smart contracts have been on the rise, which have led to financial loss and erosion of trust. Therefore, it is important to enable developers to discover security vulnerabilities in smart contracts before deployment. A number of static analysis tools have been developed for finding security bugs in smart contracts. However, despite the numerous bug-finding tools, there is no systematic approach to evaluate the proposed tools and gauge their effectiveness. This paper proposes SolidiFI, an automated and systematic approach for evaluating smart contract static analysis tools. SolidiFI is based on injecting bugs (i.e., code defects) into all potential locations in a smart contract to introduce targeted security vulnerabilities. SolidiFI then checks the generated buggy contract using the static analysis tools, and identifies the bugs that the tools are unable to detect (false-negatives) along with identifying the bugs reported as false-positives. SolidiFI is used to evaluate six widely-used static analysis tools, namely, Oyente, Securify, Mythril, SmartCheck, Manticore and Slither, using a set of 50 contracts injected by 9369 distinct bugs. It finds several instances of bugs that are not detected by the evaluated tools despite their claims of being able to detect such bugs, and all the tools report many false positives
