| Smart contracts,as an important component of blockchain technology,carry a large amount of business logic and asset value.Therefore,ensuring the security of smart contracts is crucial.Smart contract vulnerability detection is an important research topic in academia.Currently,vulnerability detection based on bytecode in the inter-contract scenario has become a hot research topic.However,due to the fact that current mainstream smart contract vulnerability detection tools do not consider the calling relationship between smart contracts,their performance is inadequate in the inter-contract scenario.Existing research on bytecode-based inter-contract smart contract vulnerability detection has resulted in false positives and false negatives due to the lack of consideration of data dependency relationships between contracts or the failure to cover implicit or indirect data flow dependency relationships,which affects the accuracy and completeness of smart contract vulnerability detection.To address this issue,this thesis proposes a new method for smart contract vulnerability detection in the inter-contract scenario.The thesis mainly completes the following five aspects of work:(1)Researches the formal definition and automatic construction algorithm of inter-contract dependency graph(ICDG)in cross-contract scenarios,to represent the dependency relationship between smart contracts;(2)In order to fully reflect the interaction behavior of multiple smart contracts in cross-contract scenarios,proposes a mining strategy for called smart contracts based on historical transaction records.(3)According to the vulnerability characteristics in cross-contract scenarios,marks the vulnerability trigger points in ICDG,and designs the vulnerability trigger point priority criteria to guide the selection of the starting nodes of the vulnerability detection key path;(4)Combines the vulnerability characteristics and dependency relationship to formulate a reverse search strategy,which guides the generation of the vulnerability trigger key path;(5)In order to improve the efficiency of smart contract vulnerability detection in cross-contract scenarios,designs a test data generation strategy based on genetic algorithm to detect whether the vulnerability is triggered.To evaluate the effectiveness of the proposed method,the thesis conducts experiments on a labeled inter-contract dataset and 39443 real-world Ethereum smart contracts and compares it with four smart contract vulnerability detection tools.The experimental results show that the proposed method has stronger smart contract vulnerability detection capabilities in the inter-contract scenario,with a recall rate of 89.5%.The method also performs better or equally well in smart contract vulnerability detection on single contracts compared to other tools. |
