论文标题
HCC：独立于语言的智能合同合同编译器
HCC: A Language-Independent Hardening Contract Compiler for Smart Contracts
论文作者
论文摘要
制定安全的智能合约仍然是一项具有挑战性的任务。现有的方法要么不切实际，要么给开发人员留下负担，以解决错误。在本文中，我们提出了第一个称为HCC的实用智能合同编译器，该编译器将根据新颖和与语言无关的代码属性图（CPG）符号自动插入源代码级别的安全性硬化检查。我们开发的CPG的高表现力使我们能够减轻所有最常见的智能合同漏洞，即重新抛弃，整数错误，自杀式智能合约，不当使用tx.origin，未经接触的委托会议，以及未检查的低级呼叫错误。我们对10K现实世界合同以及相关工作的几套易受伤害合同的大规模评估表明，HCC是高度实用的，表现优于最先进的合同硬化技术，并有效防止所有经过验证的攻击交易而不会阻碍功能正确性。
Developing secure smart contracts remains a challenging task. Existing approaches are either impractical or leave the burden to developers for fixing bugs. In this paper, we propose the first practical smart contract compiler, called HCC, which automatically inserts security hardening checks at the source-code level based on a novel and language-independent code property graph (CPG) notation. The high expressiveness of our developed CPG allows us to mitigate all of the most common smart contract vulnerabilities, namely reentrancy, integer bugs, suicidal smart contracts, improper use of tx.origin, untrusted delegate-calls, and unchecked low-level call bugs. Our large-scale evaluation on 10k real-world contracts and several sets of vulnerable contracts from related work demonstrates that HCC is highly practical, outperforms state-of-the-art contract hardening techniques, and effectively prevents all verified attack transactions without hampering functional correctness.
