论文标题
et tu，区块链？通过社会工程超越智能合同
Et tu, Blockchain? Outsmarting Smart Contracts via Social Engineering
论文作者
论文摘要
我们在以太坊中揭示了六次零日社会工程攻击，并将其分为两个类别：地址操纵和同型。我们通过将攻击嵌入五个流行的智能合约的源代码中，总资本化超过29亿美元，并表明攻击能够在测试阶段保持休眠状态，并且仅在生产部署后激活。我们分析了85,656份开源智能合约，并找到1,027份合同，可直接用于执行社会工程攻击。对于负责任的披露，我们与七家智能合同安全公司联系。本着开放研究的精神，我们制作了攻击基准，工具和数据集的源代码。
We reveal six zero-day social engineering attacks in Ethereum, and subdivide them into two classes: Address Manipulation and Homograph. We demonstrate the attacks by embedding them in source codes of five popular smart contracts with combined market capitalization of over \$29 billion, and show that the attacks have the ability to remain dormant during the testing phase and activate only after production deployment. We analyze 85,656 open source smart contracts and find 1,027 contracts that can be directly used for performing social engineering attacks. For responsible disclosure, we contact seven smart contract security firms. In the spirit of open research, we make the source codes of the attack benchmark, tools, and datasets available to the public.
