基于函数依赖的智能合约TOD漏洞检测
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

基金项目:

湖北省重大科技攻关项目(尖刀) (2023BAA027)


Function-dependency-based TOD Vulnerability Detection in Smart Contract
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    随着区块链技术的广泛应用, 智能合约的安全性问题日益突出. 交易顺序依赖 (transaction order dependency, TOD)漏洞是一种常见且危害性极大的漏洞, 可能引发严重的经济损失. 现有漏洞检测方法主要分为静态分析和动态分析, 但仍存在误报率高、关键路径覆盖不足及对固定规则依赖等局限性. 为此, 本文提出了一种基于函数依赖指导的TOD漏洞检测框架FuncFuzz. 该框架通过静态分析模块提取合约的关键函数依赖, 精准定位脆弱区域, 提升测试用例生成的针对性; 设计多样化的交易变异策略, 扩展测试用例的覆盖范围; 并引入基于状态的一致性判定机制, 以突破传统固定模式的限制, 动态适应复杂或未知的漏洞场景. 实验结果表明, FuncFuzz在检测TOD漏洞的有效性方面优于现有工具, 同时函数依赖指导有效增强了检测效果.

    Abstract:

    Security issues in smart contracts have become increasingly prominent with the widespread use of blockchain technology. The transaction order dependency (TOD) vulnerability is a common and highly hazardous flaw that can lead to significant financial losses. Existing detection methods primarily consist of static and dynamic analysis methods but still face challenges such as high false positive rates, insufficient coverage of key paths, and reliance on fixed rules. To address these issues, this study introduces FuncFuzz, a novel TOD vulnerability detection framework guided by functional dependence. This framework uses a static analysis module to extract key functional dependence within contracts, accurately locates vulnerable areas, and enhances the specificity of generated test cases. In addition, it designs diverse transaction mutation strategies to expand test case coverage and introduces a state-based consistency determination mechanism to break through the constraints of traditional fixed patterns and dynamically adapt to complex or unknown vulnerability scenarios. Experimental results show that FuncFuzz outperforms existing tools in detecting TOD vulnerabilities, and guidance by functional dependence significantly enhances detection effectiveness.

    参考文献
    相似文献
    引证文献
引用本文

姜天琪,严飞.基于函数依赖的智能合约TOD漏洞检测.计算机系统应用,2025,34(9):1-10

复制
分享
相关视频

文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2025-01-05
  • 最后修改日期:2025-02-12
  • 录用日期:
  • 在线发布日期: 2025-07-25
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62661041 传真: Email:csa@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号