[论文解读] Elysium: Automagically Healing Vulnerable Smart Contracts Using Context-Aware Patching

Christof Ferreira Torres, Hugo Jonker+1 more|arXiv (Cornell University)|Aug 23, 2021

Blockchain Technology Applications and Security参考文献 34被引用 7

一句话总结

Elysium 是一种可扩展的、上下文感知的框架，通过结合从字节码推断出的模板化修补和语义修补技术，在智能合约部署前实现自动修复。与现有工具相比，它能修复多出30%的漏洞合约，同时将交易成本增加最小化，展现出在保护基于区块链的程序方面卓越的有效性和效率。

ABSTRACT

Smart contracts are programs that are deployed and executed on the blockchain. Typically, smart contracts govern assets; popular smart contracts can govern assets worth millions. Just like traditional programs, smart contracts are subject to programming mistakes. However, a major difference is that smart contracts cannot be patched once deployed. Several approaches have been studied to improve smart contract security, by detecting bugs prior to deployment, allowing contracts to be updated, or modifying clients to prevent attacking transactions. The most elegant solution would be to automatically eliminate bugs prior to deployment. Merely identifying bugs is not enough. This became evident when the Parity wallet was hacked a second time after being manually patched following a security audit. Automatic pre-deployment patching offers a powerful promise to strengthen smart contract defenses. Current approaches are limited in the types of vulnerabilities that can be patched, in the flexibility of the patching process, and in scalability. In this paper we propose Elysium, a scalable approach towards automatic smart contract repair, that combines template-based patching with semantic patching by inferring context information from the bytecode. Elysium can currently automatically patch 7 known vulnerabilities in smart contracts using external bug-finding tools, and it can easily be extended with new templates and new bug-finding tools. We evaluate effectiveness and correctness of Elysium using 3 different datasets by replaying more than 500K transactions against patched contracts. We find that Elysium outperforms existing tools by patching at least 30% more contracts. Finally, we compare the overhead in terms of deployment and transaction cost increase. In comparison to other tools, Elysium minimizes transaction cost (up to a factor of 1.9), for only a marginally higher deployment cost.

研究动机与目标

• 解决智能合约发布后安全修复的严峻挑战，因为手动修复不可逆且成本高昂。
• 克服现有自动化修补工具在可扩展性、灵活性以及对多样化漏洞支持方面的局限。
• 开发一种预部署修复系统，通过从字节码推断上下文信息，实现准确且可扩展的修补生成。
• 在最大化修复合约数量的同时，最小化部署和交易成本的增加。
• 提供一个模块化框架，支持与外部漏洞检测工具集成，并可扩展修补模板。

提出的方法

• Elysium 通过字节码分析推断智能合约行为的上下文信息，实现上下文感知的修补。
• 结合模板化修补与语义修补技术，为已知漏洞生成正确且安全的修复方案。
• 系统利用外部静态分析工具检测漏洞，并将漏洞映射到合适的修复模板。
• 修补操作在部署前完成，确保仅经验证的安全合约被发布到区块链上。
• 通过支持集成新的漏洞检测工具和新的修补模板，实现框架的可扩展性。
• Elysium 通过在三个数据集上对超过50万笔交易进行交易回放，验证修补的正确性和安全性。

实验结果

研究问题

• RQ1 一种预部署的、上下文感知的修补系统能否有效修复广泛范围的智能合约漏洞？
• RQ2 与现有自动化修复工具相比，Elysium 的修补准确率和覆盖范围如何？
• RQ3 在部署和交易成本方面，Elysium 的性能开销如何？
• RQ4 Elysium 在不同智能合约模式和漏洞类型上的可扩展性如何？
• RQ5 在无手动干预的情况下，Elysium 如何保持修补过程的正确性和安全性？

主要发现

• 与现有工具相比，Elysium 至少能修复多出30%的漏洞合约，展现出更优的覆盖范围和有效性。
• 该框架成功修复了7种已知的智能合约漏洞，结合使用了模板化修补和语义修补技术。
• 交易成本增加被最小化，Elysium 在成本效率方面相比其他工具最高可提升1.9倍。
• 部署成本增加微乎其微，表明 Elysium 在实际区块链部署中具有可行性。
• 通过在三个数据集上对超过50万笔交易进行广泛的交易回放，系统验证了修补的可靠性，保持了正确性。
• Elysium 的模块化设计支持与外部静态分析工具无缝集成，并可扩展修补模板。