论文标题
火山：使用代码克隆分析检测以太坊智能合约的漏洞
VOLCANO: Detecting Vulnerabilities of Ethereum Smart Contracts Using Code Clone Analysis
论文作者
论文摘要
基于区块链技术（BT）的以太坊智能合约可以使区块链网络上的同行之间的货币交易独立于中央授权机构。 Ethereum Smart合同是将分散应用程序部署的程序，具有区块链共识协议的基础。这使消费者能够在透明且无冲突的环境中达成协议。但是，这些智能合约中存在一些安全漏洞，这些脆弱性对应用程序及其消费者构成了潜在威胁，并且过去曾证明造成巨大的财务损失。本文提出了一个框架和经验分析，该框架使用代码克隆检测技术来识别漏洞及其在智能合约中的变化。我们的经验分析是使用大约50k以太坊智能合约的数据集上的NICAD代码克隆检测工具进行的。我们在两个数据集上评估了火山，一个是确认的漏洞，另一个具有大约50k随机智能合约，从埃塞来说。与两种公开可用的静态分析仪相比，我们的方法在覆盖范围和效率方面显示出漏洞的检测有所改善，以检测智能合约中的漏洞。据我们所知，这是第一项使用克隆检测技术来识别漏洞及其在以太坊智能合约中的进化的研究。
Ethereum Smart Contracts based on Blockchain Technology (BT) enables monetary transactions among peers on a blockchain network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This enables consumers to make agreements in a transparent and conflict-free environment. However, there exist some security vulnerabilities within these smart contracts that are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. This paper presents a framework and empirical analysis that use code clone detection techniques for identifying vulnerabilities and their variations in smart contracts. Our empirical analysis is conducted using the Nicad code clone detection tool on a dataset of approximately 50k Ethereum smart contracts. We evaluated VOLCANO on two datasets, one with confirmed vulnerabilities and another with approximately 50k random smart contracts collected from the Etherscan. Our approach shows an improvement in the detection of vulnerabilities in terms of coverage and efficiency when compared to two of the publicly available static analyzers to detect vulnerabilities in smart contracts. To the best of our knowledge, this is the first study that uses a clone detection technique to identify vulnerabilities and their evolution in Ethereum smart contracts.
