Smart contract, one of the most successful applications of blockchain, is taking the world by storm, playing an essential role in the blockchain ecosystem. However, frequent smart contract security incidents not only result in tremendous economic losses but also destroy the blockchain-based credit system. The security and reliability of smart contracts thus gain extensive attention from researchers worldwide. In this survey, we first summarize the common types and typical cases of smart contract vulnerabilities from three levels, i.e., Solidity code layer, EVM execution layer, and Block dependency layer. Further, we review the research progress of smart contract vulnerability detection and classify existing counterparts into five categories, i.e., formal verification, symbolic execution, fuzzing detection, intermediate representation, and deep learning. Empirically, we take 300 real-world smart contracts deployed on Ethereum as the test samples and compare the representative methods in terms of accuracy, F1-Score, and average detection time. Finally, we discuss the challenges in the field of smart contract vulnerability detection and combine with the deep learning technology to look forward to future research directions.
翻译:智能合同是链链中最成功的应用之一,智能合同正在以暴风雨方式占据世界,在链链生态系统中发挥着必不可少的作用。然而,频繁的智能合同安全事件不仅造成了巨大的经济损失,而且还摧毁了基于链链的信用系统。智能合同的安全和可靠性因此得到了全世界研究人员的广泛关注。在本次调查中,我们首先总结了三个层次上智能合同脆弱性的常见类型和典型案例,即:固态代码层、EVM执行层和区块依赖层。此外,我们审查了智能合同脆弱性检测的研究进展,并将现有对应方分为五类,即正式核查、象征性执行、模糊检测、中间代表制和深层学习。我们从测试样本中抽取300份实际世界智能合同,并在精度、F1-Score和平均检测时间方面对代表性方法进行比较。最后,我们讨论了智能合同脆弱性检测领域的挑战,并与深层次的学习技术相结合,以展望未来的研究方向。