自动将漏洞描述转为可执行的智能合约攻击代码
PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts
- 采用推理-行动-观察循环，自主调用工具生成攻击代码
- 在23个真实漏洞报告上生成了正确且可运行的攻击例证
- 适合安全审计人员快速验证漏洞真实性
智能合约运行在高度对抗的环境中，漏洞可能导致重大财务损失，因此需进行安全审计。在审计中，概念性证明（PoC）攻击至关重要，能向利益相关方展示漏洞真实、可复现且可操作。然而，手动编写PoC耗时、易错，且常受审计周期限制。我们提出PoCo，一个代理式框架，能从审计员撰写的自然语言漏洞描述中自动生成可执行的PoC攻击代码。PoCo通过推理-行动-观察循环，自主调用一组代码执行工具，生成与Foundry测试框架兼容的完整可执行攻击代码，可直接集成到审计报告及其他安全工具中。我们在23个真实世界漏洞报告数据集上评估PoCo，结果表明其持续优于零样本和工作流基线，生成的PoC结构正确、逻辑无误。结果表明，代理式框架可显著降低高质量PoC的构建成本。本研究为智能合约安全社区提供了可落地的知识。
原文摘要 · Abstract (English)
Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. In auditing, proof-of-concept (PoC) exploits play a critical role by demonstrating to the stakeholders that the reported vulnerabilities are genuine, reproducible, and actionable. However, manually creating PoCs is time-consuming, error-prone, and often constrained by tight audit schedules. We introduce PoCo, an agentic framework that automatically generates executable PoC exploits from natural-language vulnerability descriptions written by auditors. PoCo autonomously generates PoC exploits in an agentic manner by interacting with a set of codeexecution tools in a Reason-Act-Observe loop. It produces fully executable exploits compatible with the Foundry testing framework, ready for integration into audit reports and other security tools. We evaluate PoCo on a dataset of 23 real-world vulnerability reports. PoCo consistently outperforms the Zero-shot and Workflow baselines, generating well-formed and logically correct PoCs. Our results demonstrate that agentic frameworks can significantly reduce the effort required for high-quality PoCs in smart contract audits. Our contribution provides actionable knowledge for the smart contract security community.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。