Abstract:

Smart contracts are programs deployed on the blockchain that enable distributed transactions.However,due to the financial attributes and immutable characteristics of smart contracts,they become targets of hacker attacks.Therefore,to ensure the security of contracts,it is necessary to repair vulnerable contracts.However,existing contract vulnerability repair schemes have problems such as low repair success rate and inability to handle complex contracts.To this end,a contract vulnerability repair scheme supporting inline data processing is proposed in this paper.The proposed scheme first studies and formalizes the dynamic loading mechanism of the Ethereum virtual machine,and constructs an inline data location algorithm based on memory copy instructions to parse and decompile the smart contract bytecode structure;then the smart contract bytecode is rewritten based on the trampoline mechanism,and the inline data address offset caused by rewriting is corrected,and finally the smart contract vulnerability repair is implemented.A prototype tool named SCRepair is implemented based on the proposed scheme,which is deployed on the local test network Ganache for performance testing,and compared with existing vulnerability repair tools EVMPatch and Smartshield.Experimental results show that the SCRepair improves the bytecode rewrite success rate by 26.9% when compared with the EVMPatch.Besides,the SCRepair has a better rewrite execution stability,and is less affected by the compiler version;the SCRepair can handle complex contracts better when compared with the Smartshield.

Key words: blockchain, smart contract, bytecode rewriting, decompilation, trampoline