As smart contracts have become increasingly essential across blockchain applications, ensuring their security has become crucial. Integer overflow vulnerabilities pose significant risks, potentially leading to unexpected behaviors and financial losses. As smart contracts execute on blockchain networks, they consume gas; however, current vulnerability remediation methods often overlook gas consumption during repairs. This study proposes SmartAR, a novel tool designed to automatically repair integer overflow vulnerabilities in smart contracts while minimizing gas consumption. By defining false positive identification rules, we can effectively filter out false positives in existing vulnerability detection, clearly identifying the integer overflow vulnerabilities that require repair. Furthermore, we present a symbolic execution-based algorithm to identify and reuse existing secure arithmetic functions, thereby further minimizing gas costs. The experimental results confirm that SmartAR not only improves the accuracy of repairs but also substantially reduces deployment and execution costs. The open-source release of this method provides valuable support for future research in smart contract security and highlights the potential of template-based repair and code reuse.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

SmartAR: Gas-Efficient Automated Repair for Integer Overflow Vulnerabilities in Smart Contracts

  • Qingyuan Huang,
  • Yue Ju,
  • Ying Shang,
  • Yang Zhou

摘要

As smart contracts have become increasingly essential across blockchain applications, ensuring their security has become crucial. Integer overflow vulnerabilities pose significant risks, potentially leading to unexpected behaviors and financial losses. As smart contracts execute on blockchain networks, they consume gas; however, current vulnerability remediation methods often overlook gas consumption during repairs. This study proposes SmartAR, a novel tool designed to automatically repair integer overflow vulnerabilities in smart contracts while minimizing gas consumption. By defining false positive identification rules, we can effectively filter out false positives in existing vulnerability detection, clearly identifying the integer overflow vulnerabilities that require repair. Furthermore, we present a symbolic execution-based algorithm to identify and reuse existing secure arithmetic functions, thereby further minimizing gas costs. The experimental results confirm that SmartAR not only improves the accuracy of repairs but also substantially reduces deployment and execution costs. The open-source release of this method provides valuable support for future research in smart contract security and highlights the potential of template-based repair and code reuse.