APSEC 2022
Tue 6 - Fri 9 December 2022
Thu 8 Dec 2022 13:20 - 13:35 at Room2 - Smart Contract Chair(s): Yoshiki Higo

In 2016, the famous attack on the smart contract named TheDAO led to a financial loss of 60 million dollars. Since then, attacks on smart contracts have increased. Thus, the security issue of smart contracts has attracted more and more attention from the community, putting pressure on developers to discover security issues in smart contracts before deploying them. To address this problem, many researchers have developed smart contract analyzers to early detect potential vulnerabilities. However, a common problem with these tools is a large number of alarms with a high false positive rate. Consequently, developers need to spend much time and effort investigating the alarms which are falsely detected as vulnerable. In this paper, we propose SCAR, a novel approach to prioritize the alarms of static analysis tools. Based on the intuition that alarms with similar contexts tend to have the same labels (true positive or false positive), SCAR is built with two deep learning models to capture the patterns associated with the contexts of the labeled alarms. After that, for new alarms, SCAR calculates their likelihood to be true positives and ranks them according to the predicted scores. SCAR is evaluated on a large data set of 14,184 alarms from 47,518 real-world smart contracts. The results show that the programmers can productively find up to two-thirds of the actual vulnerabilities by investigating only 20% of the ranked alarms.

Thu 8 Dec

Displayed time zone: Osaka, Sapporo, Tokyo change

13:00 - 14:30
Smart ContractTechnical Track / ERA - Early Research Achievements at Room2
Chair(s): Yoshiki Higo Osaka University
13:00
20m
Paper
Grey-box Fuzzing Based on Execution Feedback for EOSIO Smart Contracts
Technical Track
Wenyin Li Hebei university, Meng Wang Hebei university, Bin Yu Xidian University, Yuhang Shi Xidian Univeristy, Mingxin Fu Xidian Univeristy, You Shao Xidian Univeristy
13:20
15m
Paper
SCAR: Smart Contract Alarm Ranking}
ERA - Early Research Achievements
Kien Tran VNU University of Engineering and Technology, Hieu Vo VNU University of Engineering and Technology
13:35
20m
Paper
Data Flow Reduction Based Test Case Generation for Smart Contracts
Technical Track
Shunhui Ji Hohai University, Shaoqing Zhu Hohai University, Pengcheng Zhang Hohai University, Hai Dong RMIT University
13:55
20m
Paper
A Reference Architecture for Blockchain-based Traceability Systems Using Domain-Driven Design and Microservices
Technical Track
Yanze Wang Nanjing University, Shanshan Li Nanjing University, Huikun Liu Nanjing University, He Zhang Nanjing University, Bo Pan Huawei Technologies Co., Ltd.