Smart contracts written in Solidity are widely used in different blockchain platforms such as Ethereum, TRON and BNB Chain. One of the unique designs in Solidity smart contracts is its state-reverting mechanism for error handling and access control. Unfortunately, a number of recent security incidents showed that adversaries also utilize this mechanism to manipulate critical states of smart contracts, and hence, bring security consequences such as illegal profit-gain and Deny-of-Service (DoS). In this paper, we call such vulnerabilities as the State-reverting Vulnerability (SRV). Automatically identifying SRVs poses unique challenges, as it requires an in-depth analysis and understanding of the state-dependency relations in smart contracts. This paper presents SmartState, a new framework for detecting state-reverting vulnerability in Solidity smart contracts via fine-grained state-dependency analysis. SmartState integrates a set of novel mechanisms to ensure its effectiveness. Particularly, Smart-State extracts state dependencies from both contract bytecode and historical transactions. Both of them are critical for inferring dependencies related to SRVs. Further, SmartState models the generic patterns of SRVs (i.e., profit-gain and DoS) as SRV indicators, and hence effectively identify SRVs based on the constructed state-dependency graph. To evaluate SmartState, we manually annotated a ground-truth dataset which contains 91 SRVs in the real world. Evaluation results showed that SmartState achieves a precision of 87.23% and a recall of 89.13%. In addition, SmartState successfully identifies 406 new SRVs from 47,351 real-world smart contracts. 11 of these SRVs are from popular smart contracts with high transaction amounts (i.e., top 2000). In total, our reported SRVs affect a total amount of digital assets worth 428,600 USD.

翻译：使用Solidity编写的智能合约广泛应用于以太坊、波场和BNB链等不同区块链平台。Solidity智能合约的一项独特设计是其用于错误处理和访问控制的状态回滚机制。然而，近期多起安全事件表明，攻击者同样利用该机制操纵智能合约的关键状态，从而引发非法获利和拒绝服务（DoS）等安全后果。本文将此类漏洞定义为状态回滚漏洞（SRV）。自动识别SRV面临独特挑战，因其需要对智能合约中的状态依赖关系进行深度分析与理解。本文提出SmartState——一种通过细粒度状态依赖分析检测Solidity智能合约中状态回滚漏洞的新框架。SmartState集成了一系列创新机制以确保其有效性：该框架同时从合约字节码和历史交易中提取状态依赖关系，这两者对推断SRV相关依赖至关重要；进一步地，SmartState将SRV的通用模式（即获利型与DoS型）建模为SRV指示器，从而基于构建的状态依赖图有效识别SRV。为评估SmartState，我们人工标注了包含91个真实世界SRV的基准数据集。评估结果表明，SmartState达到87.23%的精确率与89.13%的召回率。此外，SmartState成功从47,351个真实智能合约中识别出406个新型SRV，其中11个来自交易量排名前2000的热门合约。我们披露的SRV总计影响价值428,600美元的数字资产。