计算机科学与探索

• 学术研究 •    下一篇

智能合约漏洞检测与修复研究综述

刘哲旭, 李雷孝, 刘东江, 杜金泽, 林浩, 史建平   

  1. 1. 内蒙古工业大学 数据科学与应用学院, 呼和浩特 010080
    2. 内蒙古自治区基于大数据的软件服务工程技术研究中心, 呼和浩特 010080
    3. 天津理工大学 计算机科学与工程学院, 天津 300384
    4. 鄂尔多斯市市民卡建设有限公司, 鄂尔多斯 017099

Smart contract vulnerability detection and repair research review

LIU Zhexu, LI Leixiao, LIU Dongjiang, DU Jinze, LIN Hao, SHI Jianping   

  1. 1.College of Data Science and Application, Inner Mongolia University of Technology, Hohhot 010080, China
    2.Inner Mongolia Autonomous Region Software Service Engineering Technology Research Center Based on  Big Data, Hohhot 010080, China
    3.College of Computer Science and Engineering, Tianjin University of Technology, Tianjin 300384, China
    4.Ordos Citizen Card Construction Co., Ltd., Ordos, 017099

摘要: 智能合约是区块链的关键技术之一,它不依赖第三方权威机构,能够直接为用户双方提供可信的定制化服务,是区块链2.0的重要标志。随着智能合约应用范围的不断扩大,保障其安全可靠运行成为区块链安全领域的迫切问题。提出智能合约漏洞检测与修复研究框架,分别从漏洞数据集、机器学习方法、漏洞修复技术和补丁部署策略这4个方面分析总结现有智能合约漏洞检测与修复研究进展。首先,对基于机器学习的智能合约漏洞检测方法进行研究,对比总结了8种智能合约漏洞类型、15个开源数据集现状以及传统机器学习方法、深度学习方法和大模型方法等现有模型方法优缺点,并提出使用符号执行、模糊测试、污点分析、形式化验证和集成框架5类漏洞检测工具与置信学习相结合的智能合约高质量数据集制作思路;其次,分类介绍了自动化修复技术和机器学习修复技术和以太坊增强技术3类智能合约漏洞修复方案,全面比较了不同方案的优缺点,并总结了未来可以用于智能合约漏洞修复领域的相关技术;最后,分析与展望了智能合约安全现存问题和未来研究方向。

关键词: 区块链, 智能合约安全, 漏洞检测, 漏洞修复, 机器学习

Abstract: The smart contract is a fundamental technology of blockchain, as it operates without the need for third-party authorities and can directly provide trusted customized services to users. It represents an important advancement in blockchain technology. As the application range of smart contracts continues to expand, ensuring their safe and reliable operation has become a pressing issue in the field of blockchain security. This paper first examines vulnerability detection of smart contracts using machine learning, analyzing and summarizing different types of vulnerabilities, the status of data sets, classification methods, and advantages and disadvantages of existing model approaches. It also proposes the idea of creating high-quality data sets for smart contracts by combining static analysis tools with trust learning. Additionally, this paper introduces existing schemes for repairing smart contract vulnerabilities, comprehensively comparing their advantages and disadvantages while summarizing related technologies that could be used in future smart contract vulnerability repair efforts. Finally, it analyzes current issues and prospects future research directions for smart contract security.

Key words: blockchain, smart contract security, vulnerability detection, vulnerability repair, machine learning