Automated Generation of Security-Centric Descriptions for Smart Contract Bytecode

Smart contract and DApp users are taking great risks, as they do not obtain necessary knowledge that can help them avoid using vulnera- ble and malicious contract code. In this paper, we develop a novel system Tx2TXT that can automatically create security-centric textual descriptions directly from smart contract bytecode. To capture the security aspect of financial applications, we formally define a funds transfer graph to model critical funds flows in smart contracts. To ensure the expressiveness and conciseness of the descriptions de- rived from these graphs, we employ a GCN-based model to identify security-related condition statements and selectively add them to our graph models. To convert low-level bytecode instructions to human- readable textual scripts, we leverage robust API signatures to recover bytecode semantics. We have evaluated Tx2TXT on 890 well-labeled vulnerable, malicious and safe contracts where developer-crafted descriptions are available. Our results have shown that Tx2TXT out- performs state-of-the-art solutions and can effectively help end users avoid risky contracts

智能合约和去中心化应用（DApp）的用户面临着巨大风险，因为他们没有获取必要的知识来帮助自己避免使用有漏洞和恶意的合约代码。在本文中，我们开发了一种新颖的系统Tx2TXT，它能够直接从智能合约字节码自动创建以安全为核心的文本描述。为了捕捉金融应用的安全方面，我们正式定义了一个资金转移图来对智能合约中的关键资金流进行建模。为了确保从这些图中得出的描述具有表现力和简洁性，我们采用了一种基于图卷积网络（GCN）的模型来识别与安全相关的条件语句，并有选择地将它们添加到我们的图模型中。为了将低级字节码指令转换为人类可读的文本脚本，我们利用强大的应用程序编程接口（API）签名来恢复字节码语义。我们在890个有明确标注的存在漏洞、恶意以及安全的合约上对Tx2TXT进行了评估，这些合约都有开发者撰写的描述。我们的结果表明，Tx2TXT的性能优于现有最佳解决方案，并且能够有效地帮助终端用户避免有风险的合约。