Ethereum is a permissionless blockchain ecosystem that supports execution of smart contracts, the key enablers of decentralized finance (DeFi) and non-fungible tokens (NFT). However, the expressiveness of Ethereum smart contracts is a double-edged sword: while it enables blockchain programmability, it also introduces security vulnerabilities, i.e., the exploitable discrepancies between expected and actual behaviors of the contract code. To address these discrepancies and increase the vulnerability coverage, we propose a new smart contract security testing approach called transaction encapsulation. The core idea lies in the local execution of transactions on a fully-synchronized yet isolated Ethereum node, which creates a preview of outcomes of transaction sequences on the current state of blockchain. This approach poses a critical technical challenge — the well-known time-of-check/time-of-use (TOCTOU) problem, i.e., the assurance that the final transactions will exhibit the same execution paths as the encapsulated test transactions. In this work, we determine the exact conditions for guaranteed execution path replicability of the tested transactions. To demonstrate the transaction encapsulation, we implement a transaction testing tool, TxT, which reveals the actual outcomes (either benign or malicious) of Ethereum transactions. To ensure the correctness of testing, TxT deterministically verifies whether a given sequence of transactions ensues an identical execution path on the current state of blockchain. We analyze over 1.3 billion Ethereum transactions and determine that 96.5% of them can be verified by TxT. We further show that TxT successfully reveals the suspicious behaviors associated with 31 out of 37 vulnerabilities (83.8% coverage) in the smart contract weakness classification (SWC) registry. In comparison, the vulnerability coverage of all the existing defense approaches combined only reaches 40.5%.

中文翻译：

---

TxT：以太坊智能合约的实时交易封装


以太坊是一个无需许可的区块链生态系统，支持智能合约的执行，智能合约是去中心化金融（DeFi）和不可替代代币（NFT）的关键推动者。然而，以太坊智能合约的表达能力是一把双刃剑：虽然它实现了区块链可编程性，但它也引入了安全漏洞，即合约代码的预期行为和实际行为之间可利用的差异。为了解决这些差异并增加漏洞覆盖率，我们提出了一种新的智能合约安全测试方法，称为交易封装。其核心思想在于在完全同步但隔离的以太坊节点上本地执行交易，从而在区块链的当前状态上创建交易序列结果的预览。这种方法提出了一个关键的技术挑战——众所周知的检查时间/使用时间（TOCTOU）问题，即确保最终交易将表现出与封装的测试交易相同的执行路径。在这项工作中，我们确定了保证测试事务的执行路径可复制性的确切条件。为了演示交易封装，我们实现了一个交易测试工具 TxT，它揭示了以太坊交易的实际结果（良性或恶意）。为了确保测试的正确性，TxT 确定性地验证给定的交易序列是否会在区块链的当前状态上产生相同的执行路径。我们分析了超过 13 亿笔以太坊交易，并确定其中 96.5% 的交易可以通过 TxT 进行验证。我们进一步表明，TxT 成功揭示了与 37 个漏洞中的 31 个（83.8% 的覆盖率）在智能合约弱点分类 (SWC) 注册表中。相比之下，现有所有防御方法的漏洞覆盖率加起来仅达到40.5%。