Reentrancy is one of the most notorious vulnerabilities in smart contracts, resulting in significant digital asset losses. However, many previous works indicate that current Reentrancy detection tools suffer from high false positive rates. Even worse, recent years have witnessed the emergence of new Reentrancy attack patterns fueled by intricate and diverse vulnerability exploit mechanisms. Unfortunately, current tools face a significant limitation in their capacity to adapt and detect these evolving Reentrancy patterns. Consequently, ensuring precise and highly extensible Reentrancy vulnerability detection remains critical challenges for existing tools. To address this issue, we propose a tool named ReEP, designed to reduce the false positives for Reentrancy vulnerability detection. Additionally, ReEP can integrate multiple tools, expanding its capacity for vulnerability detection. It evaluates results from existing tools to verify vulnerability likelihood and reduce false positives. ReEP also offers excellent extensibility, enabling the integration of different detection tools to enhance precision and cover different vulnerability attack patterns. We perform ReEP to eight existing state-of-the-art Reentrancy detection tools. The average precision of these eight tools increased from the original 0.5% to 73% without sacrificing recall. Furthermore, ReEP exhibits robust extensibility. By integrating multiple tools, the precision further improved to a maximum of 83.6%. These results demonstrate that ReEP effectively unites the strengths of existing works, enhances the precision of Reentrancy vulnerability detection tools.
翻译:重入攻击是智能合约中最臭名昭著的漏洞之一,常导致巨额数字资产损失。然而,多项先前研究表明,当前重入漏洞检测工具存在较高误报率。更严峻的是,近年来,基于复杂多样漏洞利用机制的新型重入攻击模式层出不穷。遗憾的是,现有工具在适应和检测这些演化中的重入模式方面能力受限。因此,确保精确且高度可扩展的重入漏洞检测仍是现有工具面临的关键挑战。为解决这一问题,我们提出名为ReEP的工具,旨在降低重入漏洞检测的误报率。此外,ReEP能够集成多种工具,扩展其漏洞检测能力。它通过评估现有工具的检测结果来验证漏洞可能性并降低误报。ReEP还具备出色的可扩展性,可整合不同检测工具以提升精确性并覆盖多种漏洞攻击模式。我们在八种现有最先进的重入检测工具上应用ReEP。在保持召回率不变的前提下,这八种工具的平均精确率从原始的0.5%提升至73%。进一步地,ReEP展现出强大的可扩展性:通过集成多种工具,精确率最高提升至83.6%。这些结果表明,ReEP有效汇聚了现有研究成果的优势,显著增强了重入漏洞检测工具的精确性。