An empirical analysis of vulnerability detection tools for solidity smart contracts
The rapid adoption of blockchain technology highlighted the importance of ensuring the security of smart contracts due to their critical role in automated business logic execu- tion on blockchain platforms. This paper provides an empirical evaluation of automated vulnerability analysis tools specifically designed for Solidity smart contracts. Leveraging the extensive SmartBugs 2.0 framework, which includes 20 analysis tools, we conducted a comprehensive assessment using an annotated dataset of 2,182 instances, manually la- beled at the line level with vulnerability labels. Our evaluation highlights the detection effectiveness of these tools in detecting various types of vulnerabilities, as categorized by the DASP TOP 10 taxonomy. We evaluated the efficacy of a Large Language Model-based detection method on two popular datasets. In this case, we obtained inconsistent results with the two datasets, showing unreliable detection when analyzing real-world smart con- tracts. Our study identifies significant variations in the accuracy and reliability of differ- ent tools and demonstrates the advantages of combining multiple detection methods to improve vulnerability identification. We identified a set of 3 tools that, combined, achieve up to 76.78% found vulnerabilities, taking less than one minute to run, on average. This study contributes to the field by releasing the largest dataset of manually analyzed smart contracts with line-level vulnerability annotations and by conducting the largest empirical evaluation of tools to date.
Thu 15 OctDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
10:30 - 12:30 | Security and Other Non-Functional Properties: Security and Privacy 6Research Papers / Tools and Datasets / Journal First at Forum 2 Chair(s): Tegan Brennan Stevens Institute of Technology | ||
10:30 15mTalk | An empirical analysis of vulnerability detection tools for solidity smart contracts Journal First Francesco Salzano University of Molise, Cosmo Kevin Antenucci University of Molise, Simone Scalabrino University of Molise, Giovanni Rosa JetBrains, Rocco Oliveto University of Molise, Remo Pareschi University of Molise DOI | ||
10:45 15mResearch paper | SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and Execution Research Papers Longfei Chen Tsinghua University, China, Ruibin Yan Peking University, Taiyu Wong Tsinghua University, Yiyang Chen Tsinghua University, Wang Jialai National University of Singapore, Chao Zhang Tsinghua University | ||
11:00 15mTalk | Zero-Knowledge VMs: Security and Usability in Practice Research Papers Jinan Jiang The Hong Kong Polytechnic University, Jinzhao Chu , Pengyu Xue Hong Kong Polytechnic University, Xinghao Peng , Haoran Qin The Hong Kong Polytechnic University, Xiapu Luo Hong Kong Polytechnic University | ||
11:15 10mTalk | GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts Tools and Datasets Luca Olivieri University Ca' Foscari, Venice, Luca Negrini Ca’ Foscari University of Venice, Vincenzo Arceri University of Parma, Italy, Pietro Ferrara Ca’ Foscari University of Venice, Fausto Spoto University of Verona, Italy, Agostino Cortesi Ca’ Foscari University of Venice DOI Media Attached | ||
11:25 15mTalk | MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning Research Papers Shenao Wang Huazhong University of Science and Technology, HeJunjie , Yanjie Zhao Huazhong University of Science and Technology, Yayi Wang Ant Group, Kan Yu Ant Group, Haoyu Wang Huazhong University of Science and Technology | ||
11:40 15mTalk | LARA: Static ReDoS Detection for Regular Expressions with Lookahead via Matching Automata Research Papers Mengxi Wang Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Chengyao Peng Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Weihao Su ISCAS, Guiyi He Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Rongchen Li Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, hong huang Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Haiming Chen Institute of Software, Chinese Academy of Sciences | ||
11:55 15mTalk | How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Research Papers Zhihao Chen Fujian Normal University, Ying Zhang Wake Forest University, Yi Liu Griffith University, Gelei Deng Nanyang Technological University, Yuekang Li UNSW Sydney, Yanjun Zhang Deakin University, Jianting Ning Zhejiang Sci-Tech University, Leo Zhang Griffith University, Lei Ma The University of Tokyo & University of Alberta, Zhiqiang Li Independent Researcher | ||
12:10 10mTalk | AIALIB: A Threat Library for AI-Generated Code Tools and Datasets DOI | ||
12:20 10mTalk | Cochise: A Reference Harness for Autonomous Penetration Testing Tools and Datasets DOI Pre-print | ||