Despite the increasing popularity of Decentralized Applications (DApps), they are suffering from various vulnerabilities that can be exploited by adversaries for profits. Among such vulnerabilities, Read-Only Reentrancy (called ROR in this paper), is an emerging type of vulnerability that arises from the complex interactions between DApps. In the recent three years, attack incidents of ROR have already caused around 30M USD losses to the DApp ecosystem. Existing techniques for vulnerability detection in smart contracts can hardly detect Read-Only Reentrancy attacks, due to the lack of tracking and analyzing the complex interactions between multiple DApps. In this paper, we propose SmartReco, a new framework for detecting Read-Only Reentrancy vulnerability in DApps through a novel combination of static and dynamic analysis (i.e., fuzzing) over smart contracts. The key design behind SmartReco is threefold: (1) SmartReco identifies the boundary between different DApps from the heavy-coupled cross-contract interactions. (2) SmartReco performs fine-grained static analysis to locate points of interest (i.e., entry functions) that may lead to ROR. (3) SmartReco utilizes the on-chain transaction data and performs multi-function fuzzing (i.e., the entry function and victim function) across different DApps to verify the existence of ROR. Our evaluation of a manual-labeled dataset with 45 RORs shows that SmartReco achieves a precision of 88.63% and a recall of 86.36%. In addition, SmartReco successfully detects 43 new RORs from 123 popular DApps. The total assets affected by such RORs reach around 520,000 USD.

翻译：尽管去中心化应用（DApps）日益普及，但其仍存在各类可被攻击者利用以牟利的漏洞。在这些漏洞中，只读重入漏洞（本文称为ROR）是一种因DApp间复杂交互而新兴的漏洞类型。近三年来，ROR攻击事件已给DApp生态系统造成约3000万美元损失。现有智能合约漏洞检测技术由于缺乏对多DApp间复杂交互的追踪与分析，难以检测只读重入攻击。本文提出SmartReco——一种通过静态分析与动态分析（即模糊测试）创新性结合来检测DApp中只读重入漏洞的新框架。SmartReco的核心设计包含三方面：（1）从高度耦合的跨合约交互中识别不同DApp的边界；（2）执行细粒度静态分析以定位可能引发ROR的关注点（即入口函数）；（3）利用链上交易数据并执行跨DApp的多函数模糊测试（即入口函数与受害函数）以验证ROR的存在性。我们在包含45个ROR的人工标注数据集上的评估表明，SmartReco达到88.63%的精确率与86.36%的召回率。此外，SmartReco成功从123个主流DApp中检测出43个新的ROR漏洞，受影响的资产总额约达52万美元。