The increased adoption of smart contracts in many industries has made them an attractive target for cybercriminals, leading to millions of dollars in losses. Thus, deploying smart contracts with detected vulnerabilities (known to developers) are not acceptable, and fixing all the detected vulnerabilities is needed, which incurs high manual labor cost without effective tool support. To fill this need, in this paper, we propose ContractFix, a novel framework that automatically generates security patches for vulnerable smart contracts. ContractFix is a general framework that can incorporate different fix patterns for different types of vulnerabilities. Users can use it as a security fix-it tool that automatically applies patches and verifies the patched contracts before deploying the contracts. To address the unique challenges in fixing smart contract vulnerabilities, given an input smart contract, \tool conducts our proposed ensemble identification based on multiple static verification tools to identify vulnerabilities that are amenable for automatic fix. Then, ContractFix generates patches using template-based fix patterns and conducts program analysis (program dependency computation and pointer analysis) for smart contracts to accurately infer and populate the parameter values for the fix patterns. Finally, ContractFix performs static verification that guarantees the patched contract is free of vulnerabilities. Our evaluations on $144$ real vulnerable contracts demonstrate that \tool can successfully fix $94\%$ of the detected vulnerabilities ($565$ out of $601$) and preserve the expected behaviors of the smart contracts.

翻译：随着智能合约在多个行业的广泛采用，其已成为网络犯罪分子的诱人目标，导致数百万美元的损失。因此，部署已知存在漏洞（开发者已发现）的智能合约是不可接受的，必须修复所有已检测到的漏洞。然而，在没有有效工具支持的情况下，这需要高昂的人工成本。为满足这一需求，本文提出ContractFix——一个自动为易受攻击的智能合约生成安全补丁的新型框架。ContractFix是一个通用框架，可针对不同类型的漏洞集成不同的修复模式。用户可将其作为安全修复工具，在部署合约前自动应用补丁并验证修复后的合约。为应对智能合约漏洞修复的独特挑战，该框架对输入合约执行基于多静态验证工具的集成识别方法，定位适合自动修复的漏洞。随后，ContractFix基于模板的修复模式生成补丁，并通过程序分析（程序依赖计算与指针分析）精准推断和填充修复模式中的参数值。最后，ContractFix执行静态验证，确保修补后的合约不存在漏洞。我们在144个真实漏洞合约上的评估表明，该框架可成功修复94%的已检测漏洞（601个中的565个），同时保留智能合约的预期行为。