论文标题
以太坊智能合约中错误的框架和数据集
A Framework and DataSet for Bugs in Ethereum Smart Contracts
论文作者
论文摘要
以太坊是支持智能合约的最大区块链平台。用户通过将智能合约的字节码发布到区块链来部署智能合约。由于无法修改区块链中的数据，即使这些合同包含错误，也无法通过代码更新来修补已部署的智能合约。此外，目前既没有针对以太坊智能合约错误的全面分类框架，也没有用于检测智能合约中错误的详细标准，这使开发人员很难完全理解错误和设计新方法检测错误的负面影响。在本文中，为了填补空白，我们首先从多个来源收集了尽可能多的智能合同错误，并通过扩展软件异常的IEEE标准分类来将这些错误分为9个类别。然后，我们设计用于检测每种错误的标准，并构建涵盖各种错误的智能合约数据集。借助我们的框架和数据集，开发人员可以学习智能合约错误，并开发新的工具来检测和找到智能合约中的错误。此外，我们使用数据集评估了用于智能合约分析的最新工具，并获得了一些有趣的发现：1）MyThril，Slither和Remix是分析工具的最值得组合的组合。 2）仍然有10种错误无法通过任何分析工具检测到。
Ethereum is the largest blockchain platform that supports smart contracts. Users deploy smart contracts by publishing the smart contract's bytecode to the blockchain. Since the data in the blockchain cannot be modified, even if these contracts contain bugs, it is not possible to patch deployed smart contracts with code updates. Moreover, there is currently neither a comprehensive classification framework for Ethereum smart contract bugs, nor detailed criteria for detecting bugs in smart contracts, making it difficult for developers to fully understand the negative effects of bugs and design new approaches to detect bugs. In this paper, to fill the gap, we first collect as many smart contract bugs as possible from multiple sources and divide these bugs into 9 categories by extending the IEEE Standard Classification for Software Anomalies. Then, we design the criteria for detecting each kind of bugs, and construct a dataset of smart contracts covering all kinds of bugs. With our framework and dataset, developers can learn smart contract bugs and develop new tools to detect and locate bugs in smart contracts. Moreover, we evaluate the state-of-the-art tools for smart contract analysis with our dataset and obtain some interesting findings: 1) Mythril, Slither and Remix are the most worthwhile combination of analysis tools. 2) There are still 10 kinds of bugs that cannot be detected by any analysis tool.
