用大模型动态划分智能合约代码，防敏感信息泄露
Towards Secure Program Partitioning for Smart Contracts with LLM's In-Context Learning
- 结合静态分析与大模型上下文学习，自动划分特权与普通代码
- 78%敏感函数成功生成可编译验证的分区，代码量减少30%
- 可防御9成真实攻击，适合智能合约安全开发人员
智能合约因敏感信息泄露极易遭受操纵攻击。解决此类漏洞尤为困难，因其源于固有的数据保密性问题，而非简单实现错误。为防止敏感信息泄露，我们提出PartitionGPT，首个利用大语言模型（LLM）上下文学习能力的驱动方法，结合静态分析，将智能合约划分为特权与普通代码库，仅需少量标注的敏感变量作为指导。我们在18个标注的智能合约上评估，包含99个敏感函数。结果表明，PartitionGPT成功为78%的敏感函数生成可编译且经验证的分区，相较函数级划分方法减少约30%代码量。此外，在9起导致总计2500万美元损失的真实操纵攻击中，PartitionGPT有效阻止了8起，凸显其广泛适用潜力，证明在智能合约开发中实施安全代码划分对降低操纵风险至关重要。
原文摘要 · Abstract (English)
Smart contracts are highly susceptible to manipulation attacks due to the leakage of sensitive information. Addressing manipulation vulnerabilities is particularly challenging because they stem from inherent data confidentiality issues rather than straightforward implementation bugs. To tackle this by preventing sensitive information leakage, we present PartitionGPT, the first LLM-driven approach that combines static analysis with the in-context learning capabilities of large language models (LLMs) to partition smart contracts into privileged and normal codebases, guided by a few annotated sensitive data variables. We evaluated PartitionGPT on 18 annotated smart contracts containing 99 sensitive functions. The results demonstrate that PartitionGPT successfully generates compilable, and verified partitions for 78% of the sensitive functions while reducing approximately 30% code compared to function-level partitioning approach. Furthermore, we evaluated PartitionGPT on nine real-world manipulation attacks that lead to a total loss of 25 million dollars, PartitionGPT effectively prevents eight cases, highlighting its potential for broad applicability and the necessity for secure program partitioning during smart contract development to diminish manipulation vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。