In 2016, the famous attack on the smart contract named TheDAO led to a financial loss of 60 million dollars. Since then, attacks on smart contracts have increased. Thus, the security issue of smart contracts has attracted more and more attention from the community, putting pressure on developers to discover security issues in smart contracts before deploying them. To address this problem, many researchers have developed smart contract analyzers to early detect potential vulnerabilities. However, a common problem with these tools is a large number of alarms with a high false positive rate. Consequently, developers need to spend much time and effort investigating the alarms which are falsely detected as vulnerable. In this paper, we propose SCAR, a novel approach to prioritize the alarms of static analysis tools. Based on the intuition that alarms with similar contexts tend to have the same labels (true positive or false positive), SCAR is built with two deep learning models to capture the patterns associated with the contexts of the labeled alarms. After that, for new alarms, SCAR calculates their likelihood to be true positives and ranks them according to the predicted scores. SCAR is evaluated on a large data set of 14,184 alarms from 47,518 real-world smart contracts. The results show that the programmers can productively find up to two-thirds of the actual vulnerabilities by investigating only 20% of the ranked alarms.
Thu 8 DecDisplayed time zone: Osaka, Sapporo, Tokyo change
13:00 - 14:30 | Smart ContractTechnical Track / ERA - Early Research Achievements at Room2 Chair(s): Yoshiki Higo Osaka University | ||
13:00 20mPaper | Grey-box Fuzzing Based on Execution Feedback for EOSIO Smart Contracts Technical Track Wenyin Li Hebei university, Meng Wang Hebei university, Bin Yu Xidian University, Yuhang Shi Xidian Univeristy, Mingxin Fu Xidian Univeristy, You Shao Xidian Univeristy | ||
13:20 15mPaper | SCAR: Smart Contract Alarm Ranking} ERA - Early Research Achievements | ||
13:35 20mPaper | Data Flow Reduction Based Test Case Generation for Smart Contracts Technical Track Shunhui Ji Hohai University, Shaoqing Zhu Hohai University, Pengcheng Zhang Hohai University, Hai Dong RMIT University | ||
13:55 20mPaper | A Reference Architecture for Blockchain-based Traceability Systems Using Domain-Driven Design and Microservices Technical Track Yanze Wang Nanjing University, Shanshan Li Nanjing University, Huikun Liu Nanjing University, He Zhang Nanjing University, Bo Pan Huawei Technologies Co., Ltd. |