Scholarlink

<p>Smart contracts are integral to decentralized finance and other blockchain applications, leveraging blockchain’s immutability to ensure security and transparency. However, logic-state inconsistencies (referred to as LSI in this paper) can emerge during contract upgrades, potentially causing transaction failures, economic imbalances, or security vulnerabilities. A notable example of LSI’s impact is the 190 million Nomad bridge exploit, which underscores the significant risks associated with inconsistent upgrades. Existing tools such as static analysis, fuzz testing, and formal verification struggle to address these inconsistencies due to the complexity and dynamic nature of LSI. In this work, we present UpgradeShield, a framework that detects LSI in smart contract upgrades by integrating transaction replay, code clone analysis, and differential testing. Historical transactions are replayed on both old and new contract versions to capture execution results and storage states, while code clone analysis identifies whether logic changes require state consistency. Combining these insights, differential testing compares the behaviors of both versions under identical conditions to detect inconsistencies introduced during the upgrade process. We evaluated UpgradeShield on 2,015 proxy-based contract upgrades, demonstrating its effectiveness in detecting upgrade-related bugs. This work provides a practical solution for ensuring the security and reliability of smart contract upgrades, and we release the source code and dataset to support further research.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

UpgradeShield: Detecting logic-state in-consistencies in smart contract upgrades

  • 期刊论文

  • 发表日期：

    2026年3月17日

查看全文
  • Wei Li,
  • Yuxin Su,
  • Yuhong Nan,
  • Kaiwen Ning,
  • Jingwen Zhang,
  • Jiajing Wu,
  • Zibin Zheng

摘要

Smart contracts are integral to decentralized finance and other blockchain applications, leveraging blockchain’s immutability to ensure security and transparency. However, logic-state inconsistencies (referred to as LSI in this paper) can emerge during contract upgrades, potentially causing transaction failures, economic imbalances, or security vulnerabilities. A notable example of LSI’s impact is the 190 million Nomad bridge exploit, which underscores the significant risks associated with inconsistent upgrades. Existing tools such as static analysis, fuzz testing, and formal verification struggle to address these inconsistencies due to the complexity and dynamic nature of LSI. In this work, we present UpgradeShield, a framework that detects LSI in smart contract upgrades by integrating transaction replay, code clone analysis, and differential testing. Historical transactions are replayed on both old and new contract versions to capture execution results and storage states, while code clone analysis identifies whether logic changes require state consistency. Combining these insights, differential testing compares the behaviors of both versions under identical conditions to detect inconsistencies introduced during the upgrade process. We evaluated UpgradeShield on 2,015 proxy-based contract upgrades, demonstrating its effectiveness in detecting upgrade-related bugs. This work provides a practical solution for ensuring the security and reliability of smart contract upgrades, and we release the source code and dataset to support further research.