Efficiently Detecting Reentrancy Vulnerabilities in Complex Smart Contracts

TL;DR

This work addresses the challenge of detecting reentrancy vulnerabilities in complex smart contracts by introducing SliSE, a two-stage detector that combines program slicing on an Inter-contract Program Dependency Graph with symbolic execution verification. Stage I generates warnings by pruning irrelevant paths through dependency analysis and ETH/ERC-specific slicing rules, while Stage II recovers complete CFG paths and verifies their feasibility using a Z3-based solver. Empirical evaluation shows SliSE achieving an F1 of 78.65% on complex contracts and recall over 90% on Ethereum datasets, significantly outperforming eight state-of-the-art tools; pruning and symbolic verification are crucial for both accuracy and efficiency. The approach provides a practical, scalable solution for cross-contract vulnerability analysis, with publicly available source code and datasets to enable reproduction and further research.

Abstract

Reentrancy vulnerability as one of the most notorious vulnerabilities, has been a prominent topic in smart contract security research. Research shows that existing vulnerability detection presents a range of challenges, especially as smart contracts continue to increase in complexity. Existing tools perform poorly in terms of efficiency and successful detection rates for vulnerabilities in complex contracts. To effectively detect reentrancy vulnerabilities in contracts with complex logic, we propose a tool named SliSE. SliSE's detection process consists of two stages: Warning Search and Symbolic Execution Verification. In Stage I, SliSE utilizes program slicing to analyze the Inter-contract Program Dependency Graph (I-PDG) of the contract, and collects suspicious vulnerability information as warnings. In Stage II, symbolic execution is employed to verify the reachability of these warnings, thereby enhancing vulnerability detection accuracy. SliSE obtained the best performance compared with eight state-of-the-art detection tools. It achieved an F1 score of 78.65%, surpassing the highest score recorded by an existing tool of 9.26%. Additionally, it attained a recall rate exceeding 90% for detection of contracts on Ethereum. Overall, SliSE provides a robust and efficient method for detection of Reentrancy vulnerabilities for complex contracts.

Figures (12)

• Figure 1: The example of Reentrancy
• Figure 2: The borrow function causing Cream Finance's Reentrancy
• Figure 3: Execution phases and function calls of the borrow function
• Figure 4: Control Flow Graph (CFG) of the borrow function.
• Figure 5: The workflow of SliSE