ASTRO: Detecting Access Control Vulnerabilities in Smart Contracts via Graph Similarity Comparison

Smart contracts are programs running on blockchains, managing substantial volumes of wealth stored within the blockchain platforms. To safeguard these assets, developers design and implement access control policies. However, incomplete and incorrect access control policies allow malicious attackers to gain unauthorized access and exploit additional assets. Previous tools for detecting access control vulnerabilities in smart contracts rely on predefined patterns, specifications, or mining access control policies from historical transactions. However, these methods are constrained due to their predetermined nature and the diversity and complexity of smart contracts. <p xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">In this paper, we present <i>ASTRO</i>, a new framework employing code similarity to detect access control vulnerabilities in smart contracts. In contrast to prior approaches that heavily rely on predefined, vulnerable code samples, <i>ASTRO</i> detects whether a target contract has access control vulnerabilities by comparing it against a database of audited contracts. Moreover, to mitigate the impact of language-specific features (e.g., diverse conditional statements and modifiers) and writing style characteristics, we integrate pruning and normalization techniques. We evaluate <i>ASTRO</i> on a total of 22 smart contracts with assigned access control CVEs and those attacked because of access control vulnerabilities from the past two years. Evaluation results demonstrate that, compared to state-of-the-art tools (i.e., AChecker, SpCon), <i>ASTRO</i> surpasses all tools in recall and achieves an improvement in recall by at least 2.8 times. In addition, <i>ASTRO</i> achieves a precision of 78.33% on a dataset consisting of real-wild contracts. Furthermore, <i>ASTRO</i> successfully identified 19 exploitable vulnerable contract that can be used to directly gain access to the contract’s permissions and obtain benefits.