arXiv:2412.03938cs.LGcs.CR2024-12被引 2

JANUS能自动检测智能合约中的金融中心化风险,不依赖预设行为模式。

JANUS: A Difference-Oriented Analyzer For Financial Centralization Risks in Smart Contracts

  • 通过比较特权账户与普通账户的状态差异,识别金融相关风险
  • 在540个合约上检测准确率优于现有工具,实测发现2种新风险
  • 适合区块链安全审计人员和智能合约开发者使用

部分智能合约因定义特权账户管理他人资产而违背去中心化原则,引发金融损失。现有方法因依赖预设行为模式,难以准确检测多样化的中心化风险。本文提出JANUS,一种针对Solidity智能合约的自动化分析工具,可独立于具体行为模式检测金融中心化风险。JANUS通过分析特权账户与普通账户达到状态间的差异,并判断其是否具有金融影响。聚焦风险后果而非行为模式,相比现有工具显著提升检测准确率,可发现未知模式的风险。我们使用540个合约的数据集评估,结果表明JANUS在检测精度上优于代表性工具。此外,在33,151个真实合约数据集上,成功识别出两种其他工具未能发现的风险。我们还证明了JANUS中状态遍历与变量摘要技术不会引入误报或漏报。

原文摘要 · Abstract (English)

Some smart contracts violate decentralization principles by defining privileged accounts that manage other users' assets without permission, introducing centralization risks that have caused financial losses. Existing methods, however, face challenges in accurately detecting diverse centralization risks due to their dependence on predefined behavior patterns. In this paper, we propose JANUS, an automated analyzer for Solidity smart contracts that detects financial centralization risks independently of their specific behaviors. JANUS identifies differences between states reached by privileged and ordinary accounts, and analyzes whether these differences are finance-related. Focusing on the impact of risks rather than behaviors, JANUS achieves improved accuracy compared to existing tools and can uncover centralization risks with unknown patterns. To evaluate JANUS's performance, we compare it with other tools using a dataset of 540 contracts. Our evaluation demonstrates that JANUS outperforms representative tools in terms of detection accuracy for financial centralization risks . Additionally, we evaluate JANUS on a real-world dataset of 33,151 contracts, successfully identifying two types of risks that other tools fail to detect. We also prove that the state traversal method and variable summaries, which are used in JANUS to reduce the number of states to be compared, do not introduce false alarms or omissions in detection.

智能合约安全分析去中心化漏洞检测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。