论文标题
CoinWatch：一种基于克隆的方法，用于检测加密货币中的漏洞
CoinWatch: A Clone-Based Approach For Detecting Vulnerabilities in Cryptocurrencies
论文作者
论文摘要
近年来，加密货币已经变得非常流行。成千上万的新加密货币已经出现，提出了新的和新颖的技术，这些技术可以改善比特币对区块链数据结构和共识机制的核心创新。但是，加密货币是网络攻击的主要目标，因为它们可以在匿名交易所出售，并且大多数加密货币都可以公开使用其代码库。一个特殊的问题是加密货币中代码克隆的普遍性，这可能会扩大安全威胁。如果在一个加密货币中发现了一个漏洞，则可以将其传播到其他克隆的加密货币中。在这项工作中，我们为此问题提出了系统的补救措施，并提出了CoinWatch（CW）。鉴于在输入处报告的漏洞，CW使用代码演化分析和克隆检测技术来指示可能是脆弱的加密货币。我们使用4个CVE在1094个加密货币上应用了CW，并在384个项目中获得了786个真正的漏洞，这些漏洞已与开发人员确认并成功地报告为CVE扩展。
Cryptocurrencies have become very popular in recent years. Thousands of new cryptocurrencies have emerged, proposing new and novel techniques that improve on Bitcoin's core innovation of the blockchain data structure and consensus mechanism. However, cryptocurrencies are a major target for cyber-attacks, as they can be sold on exchanges anonymously and most cryptocurrencies have their codebases publicly available. One particular issue is the prevalence of code clones in cryptocurrencies, which may amplify security threats. If a vulnerability is found in one cryptocurrency, it might be propagated into other cloned cryptocurrencies. In this work, we propose a systematic remedy to this problem, and we propose CoinWatch (CW). Given a reported vulnerability at the input, CW uses the code evolution analysis and a clone detection technique for indication of cryptocurrencies that might be vulnerable. We applied CW on 1094 cryptocurrencies using 4 CVEs and obtained 786 true vulnerabilities present in 384 projects, which were confirmed with developers and successfully reported as CVE extensions.
