EtherEditor: Bytecode Defense Framework for Unleashing Proactive Smart Contract Security

Abstract

Smart contracts play a pivotal role in Ethereum by providing autonomous control functions and eliminating risks from third parties. However, there exists a current dearth of a universal automated solution to ensure contract security. In this paper, we propose EtherEditor, a bytecode-based framework to enhance smart contract security. EtherEditor operates independently of the source code, directly analyzing bytecode to automate the reconstruction of Control Flow Graphs (CFGs), vulnerability detection, and patching processes. The paper initiates with the development of a virtual execution engine for symbolic execution of bytecode, dynamically interpreting the effects of various opcodes on the stack. This approach culminates in the creation of a high-precision CFG at the bytecode level, capturing nuanced semantic information. This method lays a solid foundation for subsequent work. The paper then collects sensitive semantic information from the constructed CFG, including data flow and control flow characteristics, aiming to detect vulnerabilities by identifying risk instructions that contribute to vulnerabilities. Finally, the paper generates patch instances using preset patch templates based on the current contract’s context. These instances are then infused into the original bytecode via an advanced trampoline patch injection technique, ensuring the seamless operation of the amended contract. Extensive experiments demonstrate that our method achieves significant improvements in existing smart contract vulnerability detection and patch rewriting.