关键词: 静态分析工具, 耦合, 漏洞检测, 漏洞扫描流程, 元操作, 逻辑运算符, 扩展, 新型漏洞

Abstract:

In view of the problem that the static analysis tool has a high cost of expanding the vulnerability due to the strong coupling of the vulnerability scanning process code in the tool code, a smart contract vulnerability detection method based on meta-operations is proposed. This method can convert the most basic detection process in the tool into an abstract form of meta-operation and customize the vulnerability scanning process through the combination of different meta-operations and logical operators, so as to realize the detection of different vulnerabilities by writing a small amount of vulnerability scanning process syntax. The detection can improve the ability of the tool to expand the new vulnerabilities of smart contracts. The experiment results prove that the number of characters of the vulnerability description required to be written according to this method is only 8.9%~12.7% of the logic characters of the Slither tool vulnerability detection, and the false positive rate is 2% lower than that of the Slither tool. It is proved that this method can provide stronger scalability and flexibility based on ensuring the reliability of tool detection.

Key words: static analysis tool, coupling, vulnerability detection, vulnerability scanning process, meta-operation, logical operators, scalability, new vulnerabilities