CrossInspector: A Static Analysis Approach for Cross-Contract Vulnerability Detection

Xiao Chen
2024-08-27
Abstract:With the development of blockchain technology, the detection of smart contract vulnerabilities is increasingly emphasized. However, when detecting vulnerabilities in inter-contract interactions (i.e., cross-contract vulnerabilities) using smart contract bytecode, existing tools often produce many false positives and false negatives due to insufficient recovery of semantic information and inadequate consideration of contract dependencies. We present CrossInspector, a novel framework for detecting cross-contract vulnerabilities at the bytecode level through static analysis. CrossInspector utilizes a trained Transformer model to recover semantic information and considers control flow, data flow, and dependencies related to smart contract state variables to construct a state dependency graph for fine-grained inter-procedural analysis. Additionally, CrossInspector incorporates a pruning method and two parallel optimization mechanisms to accelerate the vulnerability detection process. Experiments on our manually constructed dataset demonstrate that CrossInspector outperforms the state-of-the-art tools in both precision (97\%) and recall (96.75\%), while also significantly reducing the overall time from 16.34 seconds to 7.83 seconds, almost on par with the fastest tool that utilizes bytecode for detection. Additionally, we ran CrossInspector on a randomly selected set of 300 real-world smart contracts and identified 11 cross-contract vulnerabilities that were missed by prior tools.
Cryptography and Security,Software Engineering
What problem does this paper attempt to address?
This paper attempts to solve the problem of cross - contract vulnerability detection in smart contracts. Specifically, when detecting vulnerabilities in cross - contract interactions, existing tools generate many false positives and false negatives due to the failure to fully recover semantic information and insufficient consideration of contract dependencies. In addition, these tools may face the problem of path explosion when dealing with large - scale contracts, resulting in excessive detection time. ### Core problems of the paper 1. **Insufficient semantic information recovery**: Existing tools cannot recover sufficient semantic information from bytecode, leading to inaccurate understanding of contract behavior and thus false positives. 2. **Incomplete contract dependency analysis**: Most tools only consider control - flow and data - flow dependencies, ignoring read - write dependencies and rollback dependencies of state variables, resulting in false negatives. 3. **Low efficiency**: Cross - contract call paths are complex, which may lead to path explosion and make the detection process too time - consuming. ### Solutions To solve the above problems, the paper proposes the CrossInspector framework, and its main contributions are as follows: 1. **Transformer - based semantic recovery**: - Collected more than 20,000 smart contract function source codes and classified and described the common semantic of state variables. - Manually labeled the semantic of state variables in the decompiled code and constructed a decompiled - level smart contract corpus. - Proposed a Transformer - based semantic recovery model to recover the semantic of contract state variables from the decompiled code, enhance the understanding of contract behavior and reduce false positives. 2. **Fine - grained state - dependency - graph construction**: - Comprehensively consider control - flow dependencies, data - flow dependencies, state read - write dependencies and state rollback dependencies. - Extract fine - grained state - dependency relationships and construct a state - dependency - graph (SDG) based on the given smart contract bytecode to identify a wider range of potential vulnerability areas. 3. **Parallel optimization mechanism**: - Proposed two parallel optimization mechanisms to accelerate the vulnerability entry - path search and taint - analysis processes. - The parallel memoization - search technique for multi - source and multi - target problems allows path - searching from multiple function entry points to multiple vulnerability indicators simultaneously and shares search results to reduce redundant traversals. - In the parallel taint - analysis technique, each process processes a part of data - flow taint - propagation, and the states are merged when all processes end, effectively increasing the taint - analysis speed. ### Experimental results Experiments show that CrossInspector outperforms existing tools in both precision (97%) and recall rate (96.75%), and significantly reduces the overall detection time (from 16.34 seconds to 7.83 seconds). In addition, in 300 randomly selected real - world smart contracts, CrossInspector also discovered 11 cross - contract vulnerabilities that were missed by previous tools. Through the above methods, CrossInspector can detect cross - contract vulnerabilities more accurately and efficiently, providing a strong guarantee for the security of blockchain smart contracts.