ProxyLens: Symbolic Execution and Taint-Based Analysis of Proxy Contract Vulnerabilities on Ethereum

Abstract

Proxy contracts support logic upgradeability and deployment reuse in decentralized application (DApp). However, the use of proxy mechanisms also introduces new security risks. Although prior work has explored the security of proxy contracts, most prior approaches either depend on source code or fail to handle complex proxy storage layouts at the bytecode level, reducing their applicability to real-world closed-source contracts. In this paper, we propose ProxyLens, a bytecode-level vulnerability detection framework tailored for Ethereum proxy contracts. Without requiring source code, ProxyLens integrates storage structure modeling, proxy pattern recognition, and vulnerability detection. It features (1) a slot recovery mechanism based on symbolic execution and taint analysis for precise variable layout inference, (2) a proxy identification and delegate slot tracing module for accurate proxy architecture recognition, and (3) a semantic-driven vulnerability detection engine that works independently of function names. Experiments show that ProxyLens significantly outperforms existing tools in storage slot recovery (F1 = 96.4%), variable type inference (accuracy = 63.0%), proxy pattern recognition (accuracy > 90% across multiple patterns), and vulnerability detection (e.g., function selector collision F1 = 98.77%, storage collision F1 = 79.50%). As a supplementary contribution, we have publicly released the prototype of ProxyLens.