论文标题
存款：揭开以太坊智能合约中的假存款脆弱性
DEPOSafe: Demystifying the Fake Deposit Vulnerability in Ethereum Smart Contracts
论文作者
论文摘要
近年来，由于区块链技术及其经济生态系统的发展，加密货币近年来爆炸性增长。除比特币外，数千次加密货币已分发在区块链上，而数百次加密货币交易所正在出现以促进数字资产的交易。同时，它还吸引了攻击者的注意。假存款是与交易所和代币有关的最具代表性攻击（漏洞）之一，在区块链生态系统中经常被观察到，造成了巨大的财务损失。但是，除了一些安全报告外，我们的社区缺乏对这种脆弱性的理解，例如它的规模和影响。在本文中，我们迈出的第一步使虚假的存款漏洞神秘。基于我们总结的基本模式，我们实施了存款，这是一种自动化工具，用于检测和验证（利用）ERC-20智能合约中的假存款漏洞。 Reseafe结合了几种关键技术，包括基于符号执行的静态分析和基于行为建模的动态验证。通过将存款申请到176,000 ERC-20智能合约中，我们已经确定了7,000多个可能遭受两种攻击的脆弱合同。我们的发现表明了识别和防止假存款脆弱性的紧迫性。
Cryptocurrency has seen an explosive growth in recent years, thanks to the evolvement of blockchain technology and its economic ecosystem. Besides Bitcoin, thousands of cryptocurrencies have been distributed on blockchains, while hundreds of cryptocurrency exchanges are emerging to facilitate the trading of digital assets. At the same time, it also attracts the attentions of attackers. Fake deposit, as one of the most representative attacks (vulnerabilities) related to exchanges and tokens, has been frequently observed in the blockchain ecosystem, causing large financial losses. However, besides a few security reports, our community lacks of the understanding of this vulnerability, for example its scale and the impacts. In this paper, we take the first step to demystify the fake deposit vulnerability. Based on the essential patterns we have summarized, we implement DEPOSafe, an automated tool to detect and verify (exploit) the fake deposit vulnerability in ERC-20 smart contracts. DEPOSafe incorporates several key techniques including symbolic execution based static analysis and behavior modeling based dynamic verification. By applying DEPOSafe to 176,000 ERC-20 smart contracts, we have identified over 7,000 vulnerable contracts that may suffer from two types of attacks. Our findings demonstrate the urgency to identify and prevent the fake deposit vulnerability.
