請用此 Handle URI 來引用此文件：
http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/94101完整後設資料紀錄
| DC 欄位 | 值 | 語言 |
|---|---|---|
| dc.contributor.advisor | 蕭旭君 | zh_TW |
| dc.contributor.advisor | Hsu-Chun Hsiao | en |
| dc.contributor.author | 陳正康 | zh_TW |
| dc.contributor.author | Zac Chengkang Chen | en |
| dc.date.accessioned | 2024-08-14T16:41:51Z | - |
| dc.date.available | 2024-08-15 | - |
| dc.date.copyright | 2024-08-14 | - |
| dc.date.issued | 2024 | - |
| dc.date.submitted | 2024-08-05 | - |
| dc.identifier.citation | [1] Xiaofan Li, Jin Yang, Jiaqi Chen, Yuzhe Tang, and Xing Gao. 2024. Characterizing Ethereum Upgradable Smart Contracts and Their Security Implications. In Proceed-ings of the ACM on Web Conference 2024 (WWW ’24). Association for Computing Machinery, New York, NY, USA, 1847–1858. https://doi.org/10.1145/3589334.3645640
[2] Jorge Izquierdo and Manuel Araoz. 2018. ERC-897: DelegateProxy. Retrieved 2024-06-16 from https://eips.ethereum.org/EIPS/eip-897 [3] Peter Murray, Nate Welch, and Joe Messerman. 2018. EIP-1167: Minimal Proxy Contract. Retrieved 2024-06-16 from https://eips.ethereum.org/EIPS/eip-1167 [4] Gabriel Barros and Patrick Gallagher. 2019. ERC-1822: Universal Upgradeable Proxy Standard (UUPS). Retrieved 2024-06-16 from https://eips.ethereum.org/EIPS/eip-1822 [5] Santiago Palladino, Francisco Giordano, and Hadrien Croubois. 2019. ERC-1967: Proxy Storage Slots. Retrieved 2024-06-16 from https://eips.ethereum.org/EIPS/eip-1967 [6] Nick Mudge. 2020. ERC-2535: Diamonds, Multi-Facet Proxy. Retrieved 2024-06-16 from https://eips.ethereum.org/EIPS/eip-2535 [7] Audius Music. 2022. Audius Governance Takeover Post-Mortem 7/23/22. Retrieved 2024-06-16 from https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22 [8] Shaurya Malwa. 2022. How Attackers Stole Around $1.1M Worth of Tokens From Decentralized Music Project Audius. Retrieved 2024-06-16 from https://www.coindesk.com/tech/2022/07/25/how-attackers-stole-around-11m-worth-of-tokens-from-decentralized-music-project-audius/ [9] Josselin Feist, Gustavo Grieco, and Alex Groce. 2019. Slither: A Static Analysis Framework for Smart Contracts. In 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB). 8–15. https://doi.org/10.1109/WETSEB.2019.00008 [10] William E Bodell III, Sajad Meisami, and Yue Duan. 2023. Proxy Hunting: Understanding and Characterizing Proxy-based Upgradeable Smart Contracts in Blockchains. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 1829–1846. https://www.usenix.org/conference/usenixsecurity23/presentation/bodell [11] Nicola Ruaro, Fabio Gritti, Robert McLaughlin, Ilya Grishchenko, Christopher Kruegel, and Giovanni Vigna. 2024. Not your Type! Detecting Storage Collision Vulnerabilities in Ethereum Smart Contracts. In Proceedings of the Network and Distributed System Security Symposium (NDSS). San Diego, USA. [12] 朱玟嶧. 2022. 探討以太坊代理合約所引發的安全問題. Master’s thesis. 國立臺灣大學. https://doi.org/10.6342/NTU202203210 [13] Etherscan. 2024. Etherscan - The Ethereum Blockchain Explorer. Retrieved 2024-06-16 from https://etherscan.io/ [14] Monika di Angelo, Thomas Durieux, João F Ferreira, and Gernot Salzer. 2024. Evolution of automated weakness detection in Ethereum bytecode: a comprehensive study. Empirical Software Engineering 29, 2 (2024), 41. https://doi.org/10.1007/s10664-023-10414-8 [15] Martin Ortner and Shayan Eskandari. 2018. Smart Contract Sanctuary. Retrieved 2024-06-16 from https://github.com/tintinweb/smart-contract-sanctuary [16] Etherscan. 2024. Etherscan Verified Contracts. Retrieved 2024-06-16 from https://etherscan.io/contractsVerified [17] Google BigQuery. 2024. Ethereum Cryptocurrency. Retrieved 2024-06-16 from https://console.cloud.google.com/marketplace/product/ethereum/crypto-ethereum-blockchain [18] Allen Day and Evgeny Medvedev. 2018. Ethereum in BigQuery: a Public Dataset for smart contract analytics | Google Cloud Blog. Retrieved 2024-06-16 from https://cloud.google.com/blog/products/data-analytics/ethereum-bigquery-public-dataset-smart-contract-analytics [19] Evgeny Medvedev and Allen Day. 2018. Ethereum in BigQuery: how we built this dataset | Google Cloud Blog. Retrieved 2024-06-16 from https://cloud.google.com/blog/products/data-analytics/ethereum-bigquery-how-we-built-dataset [20] João F. Ferreira, Pedro Cruz, Thomas Durieux, and Rui Abreu. 2021. Smart- Bugs: a framework to analyze solidity smart contracts. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering (ASE ’20). Association for Computing Machinery, New York, NY, USA, 1349–1352. https://doi.org/10.1145/3324884.3415298 [21] Monika di Angelo, Thomas Durieux, João F. Ferreira, and Gernot Salzer. 2023. SmartBugs 2.0: An Execution Framework for Weakness Detection in Ethereum Smart Contracts. In 2023 38th IEEE/ ACM International Conference on Automated Software Engineering (ASE). 2102–2105. https://doi.org/10.1109/ASE56229.2023.00060 [22] Thomas Durieux, João F. Ferreira, Rui Abreu, and Pedro Cruz. 2020. Empirical review of automated analysis tools on 47,587 Ethereum smart contracts. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering (ICSE ’20). Association for Computing Machinery, New York, NY, USA, 530–541. https://doi.org/10.1145/3377811.3380364 [23] Ethereum. 2024. What is Ethereum? Retrieved 2024-06-16 from https://ethereum.org/en/what-is-ethereum/ [24] Solidity Team. 2023. Solidity Programming Language. Retrieved 2024-06-16 from https://soliditylang.org/ [25] Vyper community. 2024. Vyper. Retrieved 2024-06-16 from https://vyperlang.org/ [26] Morteza Zakeri-Nasrabadi, Saeed Parsa, Mohammad Ramezani, Chanchal Roy, and Masoud Ekhtiarzadeh. 2023. A systematic literature review on source code similarity measurement and clone detection: Techniques, applications, and challenges. Journal of Systems and Software 204 (2023), 111796. https://doi.org/10.1016/j.jss.2023.111796 [27] Tinchoabbate. 2024. Beware of the proxy: learn how to exploit function clashing - Security - OpenZeppelin Forum. Retrieved 2024-06-16 from https://forum.openzeppelin.com/t/beware-of-the-proxy-learn-how-to-exploit-function-clashing/1070 [28] Christof Ferreira Torres, Mathis Steichen, and Radu State. 2019. The Art of The Scam: Demystifying Honeypots in Ethereum Smart Contracts. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 1591–1607. https://www.usenix.org/conference/usenixsecurity19/presentation/ferreira [29] OpenZeppelin. 2024. Transparent Proxy | OpenZeppelin Docs. Retrieved 2024-06-16 from https://docs.openzeppelin.com/contracts/4.x/api/proxy#transparent_proxy [30] Heidelinde Rameder, Monika di Angelo, and Gernot Salzer. 2022. Review of Automated Vulnerability Analysis of Smart Contracts on Ethereum. Frontiers in Blockchain 5 (2022). https://doi.org/10.3389/fbloc.2022.814977 [31] Satpal Singh Kushwaha, Sandeep Joshi, Dilbag Singh, Manjit Kaur, and Heung-No Lee. 2022. Ethereum Smart Contract Analysis Tools: A Systematic Review. IEEE Access 10 (2022), 57037–57062. https://doi.org/10.1109/ACCESS.2022.3169902 [32] Etherscan. 2024. Etherscan APIs. Retrieved 2024-06-16 from https://etherscan.io/apis [33] Neville Grech, Lexi Brent, Bernhard Scholz, and Yannis Smaragdakis. 2019. Gigahorse: Thorough, Declarative Decompilation of Smart Contracts. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE). 1176–1186. https://doi.org/10.1109/ICSE.2019.00120 [34] Python. 2024. multiprocessing —Process-based parallelism. Retrieved 2024-06-16 from https://docs.python.org/3/library/multiprocessing.html [35] Evgeny Medvedev and Blockchain ETL. 2018. Ethereum ETL. https://github.com/blockchain-etl/ethereum-etl [36] Apache Airflow. 2024. Apache Airflow. Retrieved 2024-05-19 from https://airflow.apache.org/ [37] XEN Crypto. 2024. XEN Crypto. Retrieved 2024-06-16 from https://www.xencrypto.io/ [38] Wyvern. 2023. Wyvern Protocol. Retrieved 2024-06-16 from https://wyvernprotocol.com/ [39] Coinbase. 2024. A new standard in global crypto payments - Coinbase. Retrieved 2024-06-16 from https://www.coinbase.com/commerce [40] Noxx. 2024. Smart Contract Patterns: The Proxy. Retrieved 2024-06-16 from https://noxx.substack.com/p/smart-contract-patterns-the-proxy [41] Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. 2023. SoK: Decentralized Finance (DeFi) Attacks. In 2023 IEEE Symposium on Secu- rity and Privacy (SP). 2444–2461. https://doi.org/10.1109/SP46215.2023.10179435 [42] Zhuo Zhang, Brian Zhang, Wen Xu, and Zhiqiang Lin. 2023. Demystifying Ex- ploitable Bugs in Smart Contracts. In Proceedings of the 45th International Conference on Software Engineering (ICSE ’23). IEEE Press, 615 –627. https://doi.org/10.1109/ICSE48619.2023.00061 [43] SunWeb3Sec. 2022. SunWeb3Sec/ DeFiHackLabs: Reproduce DeFi hacked incidents using Foundry. Retrieved 2024-06-16 from https://github.com/SunWeb3Sec/DeFiHackLabs [44] Ali Davoudian, Liu Chen, and Mengchi Liu. 2018. A Survey on NoSQL Stores. ACM Computing Surveys (CSUR) 51, 2, Article 40 (apr 2018), 43 pages. https://doi.org/10.1145/3158661 [45] Peter Macko and Jason Hennessey. 2022. Survey of Distributed File System Design Choices. ACM Transactions on Storage (TOS) 18, 1, Article 4 (mar 2022), 34 pages. https://doi.org/10.1145/3465405 [46] Rong Cao, Ting Chen, Ting Li, Xiapu Luo, Guofei Gu, Yufei Zhang, Zhou Liao, Hang Zhu, Gang Chen, Zheyuan He, Yuxing Tang, Xiaodong Lin, and Xiaosong Zhang. 2020. SODA: A Generic Online Detection Framework for Smart Contracts. In Proceedings of the 27th Network and Distributed System Security Symposium (NDSS). 1–17. [47] Voon Hou Su, Sourav Sen Gupta, and Arijit Khan. 2022. Automating ETL and Mining of Ethereum Blockchain Network. In Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining (WSDM ’22). Associ- ation for Computing Machinery, New York, NY, USA, 1581 –1584. https://doi.org/10.1145/3488560.3502187 [48] Asem Ghaleb and Karthik Pattabiraman. 2020. How effective are smart contract analysis tools? evaluating smart contract static analysis tools using bug injection. In Proceedings of the 29th ACM SIGSOFT International Symposium on Software Test- ing and Analysis (ISSTA 2020). Association for Computing Machinery, New York, NY, USA, 415–427. https://doi.org/10.1145/3395363.3397385 [49] Stefanos Chaliasos, Marcos Antonios Charalambous, Liyi Zhou, Rafaila Galanopoulou, Arthur Gervais, Dimitris Mitropoulos, and Benjamin Livshits. 2024. Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners?. In Proceedings of the IEEE/ ACM 46th International Conference on Software Engineering (ICSE ’24). Association for Computing Machinery, New York, NY, USA, Article 60, 13 pages. https://doi.org/10.1145/3597503.3623302 [50] Etherscan. 2024. Proxy Contracts. Retrieved 2024-06-16 from https://info.etherscan.com/what-is-proxy-contract/ | - |
| dc.identifier.uri | http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/94101 | - |
| dc.description.abstract | 以太坊智慧合約的代理設計模式將合約狀態和程式碼邏輯分別解耦至代理合約和邏輯合約中，為之引入了程式碼更新機制、功能重用和程式碼模組化。然而，這種靈活的設計模式也引入了新的安全風險，即函數名稱衝突和儲存位置衝突。面對現實世界中已造成數百萬美元損失的攻擊，業界和學術界對這些問題進行了研究並尋求解決方案。然而，現有研究或涵蓋不足，或依賴原始碼與區塊鏈歷史，未能全面了解以太坊上的代理合約和衝突問題。
為填補此研究缺口，我們提出了涵蓋以太坊「所有」代理合約進行全面研究的方法。我們發現現今缺乏易用且高效的解決方案來評估大型的智慧合約資料集。現有的方法或未能適當處理資料集以進行大規模分析，或無法在分散式計算環境中擴展，或未能妥善管理複雜的分析程序。 為提高效率，我們開發了 Etherspect，一個自動化且可擴展的智能合約分析平台，不僅用於分析代理合約，還能執行一般的智慧合約分析工具。Etherspect 在效率、擴展性和自動化方面表現優越。藉由 Etherspect 的預處理資料集和可擴展的依賴關係感知分析工具排程器，對所有以太坊代理合約進行的複雜大規模分析預計將從 2,228 天縮短至 25 天。最終，Etherspect 分析了 3700 萬個乙太坊智慧合約，發現了 2000 萬個代理合約、150 萬個函數名稱衝突和 2.5 萬個儲存位置衝突。 | zh_TW |
| dc.description.abstract | This flexible pattern introduces new security risks, namely function collisions and storage collisions. In the presence of real-world attacks with millions of dollars worth of loss, the industry and the academy have studied the issues and searched for solutions. However, previous research either lacks enough coverage or relies on source code or past transactions, failing to understand all proxy contracts and collision issues comprehensively.
To address the gap, we proposed a complete study of all proxy contracts in Ethereum. Simultaneously, we found the lack of a user-friendly and efficient solution to evaluate large smart contract datasets. Current solutions either do not properly tailor datasets for large-scale analysis, do not scale out in a distributed computing environment, or do not manage complex analysis procedures appropriately. For efficiency, we built Etherspect, an automated and scalable smart contract analysis platform, for not only analyzing proxy contracts but also executing general smart contract analyzers. Etherspect is shown to excel in efficiency, extensibility, and automation. With Etherspect's preprocessed dataset and scalable dependency-aware analyzer scheduler, a complicated large-scale analysis to discover and analyze all Ethereum proxy contracts is estimated to reduce from 2,228 days to 25 days, finally analyzing 37M Ethereum smart contracts, identifying 20M proxy contracts, 1.5M function collisions and 25k storage collisions. | en |
| dc.description.provenance | Submitted by admin ntu (admin@lib.ntu.edu.tw) on 2024-08-14T16:41:51Z No. of bitstreams: 0 | en |
| dc.description.provenance | Made available in DSpace on 2024-08-14T16:41:51Z (GMT). No. of bitstreams: 0 | en |
| dc.description.tableofcontents | 誌謝 iii
摘要 v Abstract vii Contents ix List of Figures xiii List of Tables xv Chapter 1 Introduction 1 Chapter 2 Background 9 2.1 Ethereum and Smart Contracts . . . . . . . . . . . . . . . . . . . . . 9 2.2 Proxy Patterns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.3 Function Collisions and Storage Collisions . . . . . . . . . . . . . . 11 Chapter 3 Design 15 3.1 Design Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.1.1 Automated and Online Evaluation . . . . . . . . . . . . . . . . . . 15 3.1.2 A Ready, Single Source of Data for Analysis . . . . . . . . . . . . . 16 3.1.3 Separating Contract Code and Contract into Distinct Logical Entities 17 3.1.4 Integration with Smart Contract Analyzers . . . . . . . . . . . . . . 17 3.1.5 A Scalable Analysis Platform . . . . . . . . . . . . . . . . . . . . . 18 3.2 Contract Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.3 Source Code Retriever . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.4 Analyzer Scheduler . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.5 Analyzer Executor . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3.6 Proxy Contract Detection Unit . . . . . . . . . . . . . . . . . . . . . 23 Chapter 4 Implementation 25 4.1 Contract Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.2 Database Schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 4.3 Source Code Retriever . . . . . . . . . . . . . . . . . . . . . . . . . 27 4.4 Analyzer Scheduler . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 4.5 Analyzer Executor . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 4.6 Proxy Contract Detection Unit . . . . . . . . . . . . . . . . . . . . . 28 Chapter 5 Finding Proxy Contracts 29 5.1 Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.2 Proxy Contract Usage . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.3 Top Duplicated and Top Referenced Proxy and Logic Contracts . . . 32 5.4 Function Collisions and Storage Collisions . . . . . . . . . . . . . . 33 5.5 Proxy Standard Adoptions . . . . . . . . . . . . . . . . . . . . . . . 35 5.6 Upgrades on Proxy Contracts . . . . . . . . . . . . . . . . . . . . . 38 Chapter 6 Evaluting Etherspect 41 6.1 Automation & Extensibility . . . . . . . . . . . . . . . . . . . . . . 41 6.2 Latency and Throughput . . . . . . . . . . . . . . . . . . . . . . . . 42 6.3 Overhead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 6.4 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 6.5 Total Time Savings by Etherspect . . . . . . . . . . . . . . . . . . 44 Chapter 7 Discussion 47 7.1 Limitations of Etherspect . . . . . . . . . . . . . . . . . . . . . . . 47 7.1.1 Smart Contract Data and Knowledge . . . . . . . . . . . . . . . . . 47 7.1.2 Scheduling Algorithm and Resource Utilization . . . . . . . . . . . 47 7.1.3 Scaling Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 7.2 Future Work of Etherspect . . . . . . . . . . . . . . . . . . . . . . 49 7.2.1 Online Vulnerability Detection . . . . . . . . . . . . . . . . . . . . 49 7.2.2 Modifying the Implementation of Analyzers . . . . . . . . . . . . . 49 7.3 Limitations of Our Study on Proxy Contracts . . . . . . . . . . . . . 50 7.4 Best Practices for Developing Proxy Contracts . . . . . . . . . . . . 50 Chapter 8 Related Work 51 Chapter 9 Conclusion 53 References 55 | - |
| dc.language.iso | en | - |
| dc.subject | 智慧合約 | zh_TW |
| dc.subject | 智能合約 | zh_TW |
| dc.subject | 代理合約 | zh_TW |
| dc.subject | 區塊鏈安全 | zh_TW |
| dc.subject | 軟體測試 | zh_TW |
| dc.subject | 分散式計算 | zh_TW |
| dc.subject | smart contracts | en |
| dc.subject | distributed computing | en |
| dc.subject | software testing | en |
| dc.subject | blockchain security | en |
| dc.subject | proxy contracts | en |
| dc.title | Etherspect: 用於探索所有以太坊代理合約的自動化可擴展智慧合約分析平臺 | zh_TW |
| dc.title | Etherspect: An Automated and Scalable Smart Contract Analysis Platform for Discovering All Proxy Contracts in Ethereum | en |
| dc.type | Thesis | - |
| dc.date.schoolyear | 112-2 | - |
| dc.description.degree | 碩士 | - |
| dc.contributor.oralexamcommittee | 黎士瑋;Muoi Tran | zh_TW |
| dc.contributor.oralexamcommittee | Shih-Wei Li;Muoi Tran | en |
| dc.subject.keyword | 智慧合約,智能合約,代理合約,區塊鏈安全,軟體測試,分散式計算, | zh_TW |
| dc.subject.keyword | smart contracts,proxy contracts,blockchain security,software testing,distributed computing, | en |
| dc.relation.page | 62 | - |
| dc.identifier.doi | 10.6342/NTU202401985 | - |
| dc.rights.note | 同意授權(全球公開) | - |
| dc.date.accepted | 2024-08-09 | - |
| dc.contributor.author-college | 電機資訊學院 | - |
| dc.contributor.author-dept | 資訊工程學系 | - |
| 顯示於系所單位： | 資訊工程學系 | |
文件中的檔案：
| 檔案 | 大小 | 格式 | |
|---|---|---|---|
| ntu-112-2.pdf | 2.3 MB | Adobe PDF | 檢視/開啟 |
系統中的文件，除了特別指名其著作權條款之外，均受到著作權保護，並且保留所有的權利。