QIAN Peng
School of Computer and Information Engineering, Zhejiang Gongshang University, Hangzhou 310018, ChinaLIU Zhen-Guang
School of Computer and Information Engineering, Zhejiang Gongshang University, Hangzhou 310018, China;School of Computer Science and Technology, Zhejiang University, Hangzhou 310058, ChinaHE Qin-Ming
School of Computer Science and Technology, Zhejiang University, Hangzhou 310058, ChinaHUANG Bu-Tian
School of Computer Science and Technology, Zhejiang University, Hangzhou 310058, ChinaTIAN Duan-Zheng
School of Computer and Information Engineering, Zhejiang Gongshang University, Hangzhou 310018, ChinaWANG Xun
School of Computer and Information Engineering, Zhejiang Gongshang University, Hangzhou 310018, ChinaNational Key R&D Program of China (2017YFB1401300, 2017YFB1401304); Natural Science Foundation of Zhejiang Province, China (LQ19F020001); National Natural Science Foundation of China (61902348); Key R&D Program of Zhejiang Province (2021C01104)
Smart contract, one of the most successful applications of blockchain, provides the foundation for realizing various real-world applications of blockchain, playing an essential role in the blockchain ecosystem. However, frequent smart contract security events not only caused huge economic losses but also destroyed the blockchain-based credit system. The security and reliability of smart contract thus gain wide attention from researchers worldwide. This study first introduces the common types and typical cases of smart contract vulnerabilities from three levels, i.e., Solidity code layer, EVM execution layer, and blockchain system layer. Then, the research progress of smart contract vulnerability detection is reviewed and existing efforts are classified into five categories, namely formal verification, symbolic execution, fuzzing testing, intermediate representation, and deep learning. The detectable vulnerability types, accuracy, and time consumption of existing vulnerability detection methods are compared in detail as well as their limitations and improvements. Finally, based on the summary of existing researches, the challenges in the field of smart contract vulnerability detection are discussed and combined with the deep learning technology to look forward to future research directions.
钱鹏,刘振广,何钦铭,黄步添,田端正,王勋.智能合约安全漏洞检测技术研究综述.软件学报,2022,33(8):3059-3085
Copy