Pluto: Exposing Vulnerabilities in Inter-Contract Scenarios

【Author】 Ma, Fuchen; Xu, Zhenyang; Ren, Meng; Yin, Zijing; Chen, Yuanliang; Qiao, Lei; Gu, Bin; Li, Huizhong; Jiang, Yu; Sun, Jiaguang

【Source】IEEE TRANSACTIONS ON SOFTWARE ENGINEERING

【影响因子】9.322

【Abstract】Attacks on smart contracts have caused considerable losses to digital assets. Many techniques based on symbolic execution, fuzzing, and static analysis are used to detect contract vulnerabilities. Most of the current analyzers only consider vulnerability detection intra-contract scenarios. However, Ethereum contracts usually interact with others by calling their functions. A bug hidden in a path that depends on information from external contract calls is defined as an inter-contract vulnerability. Failure to deal with this kind of bug can result in potential false negatives and false positives. In this work, we propose Pluto, which supports vulnerability detection in inter-contract scenarios. It first builds an Inter-contract Control Flow Graph (ICFG) to extract semantic information among contract calls. Afterward, it symbolically explores the ICFG and deduces Inter-Contract Path Constraints (ICPC) to check the reachability of execution paths more accurately. Finally, Pluto detects whether there is a vulnerability based on some predefined rules. For evaluation, we compare Pluto with five state-of-the-art tools, including Oyente, Mythril, Securify, ILF, and Clairvoyance on a labeled benchmark and 39,443 real-world Ethereum smart contracts. The result shows that other tools can only detect 10% of the inter-contract vulnerabilities, while Pluto can detect 80% of them on the labeled dataset. Beyond that, Pluto has detected 451 confirmed vulnerabilities on real-world contracts, including 36 vulnerabilities in inter-contract scenarios. Two bugs have been assigned with unique CVE identifiers by the US National Vulnerability Database (NVD). On average, Pluto costs 16.9 seconds to analyze a contract, which is as fast as the state-of-the-art tools.

【Keywords】Pluto; Tools; Smart contracts; Semantics; Computer bugs; Codes; Virtual machining; Smart contracts; ethereum; inter-contract vulnerabilities

【发表时间】2022 NOV 1

【收录时间】2022-11-30

【文献类型】实证数据

【主题类别】

区块链治理-技术治理-智能合约漏洞检测