Abstract:

Smart contracts are the core of the second-generation blockchain Ethereum. They involve a large amount of cash flow but are vulnerable to hacking because of being deployed on a public chain. Therefore, potential vulnerabilities in contracts must be detected to ensure their security. However, existing detection methods have difficulty coping with the structural deception of attack codes, in-depth analysis of program logic, and mitigation of state-space explosions. To address these issues, this study first proposes a smart contract attacker modeling detection framework based on Petri nets; the framework uses abstract semantic rules and the dynamic operation characteristics of the nets to capture attack behaviors accurately and ensure high adaptability and accuracy of smart contract detection. Second, the study presents a unified detection method for multilevel vulnerabilities that combines the key features of vulnerabilities at each level to derive attack likelihoods and their potential impacts. Finally, the study presents an on-demand state-space generation mitigation mechanism for the state-space explosion problem; this mechanism improves detection efficiency and resource utilization significantly. Experimental results demonstrate that the proposed method is feasible and practical.

Key words: smart contract, Color Petri Net (CPN), attack, modeling, detection

摘要：

智能合约是第二代区块链以太坊的核心, 涉及大量资金流动, 因部署在公有链上易遭黑客攻击。因此, 检测合约潜在漏洞以确保其安全性至关重要。然而, 现有检测方法难以应对攻击代码结构性欺骗、深入解析程序逻辑、缓解状态空间爆炸等情况。为此, 构建一种基于Petri网的智能合约攻击者建模检测框架, 利用抽象语义规则和网络动态运行特性精确捕捉攻击行为, 确保智能合约检测的高适配性和高准确性。同时, 提出一种多层次漏洞统一检测方法, 结合各层次漏洞的关键特征, 推导攻击可能性及其潜在影响。针对状态空间爆炸问题, 设计一种按需生成状态空间的缓解机制, 有效提升了检测效率和资源利用率。实验结果表明, 所提检测方法具有可行性与实用性。

关键词: 智能合约, 颜色Petri网, 攻击, 建模, 检测