Publication Type

Conference Proceeding Article

Version

publishedVersion

Publication Date

8-2025

Abstract

Storage collision vulnerabilities, a significant security risk in upgradeable smart contracts, often arise when a user-facing proxy contract and a backend logic contract share storage space. While static analysis techniques can detect such issues, they often over-approximate program states, leading to false positives and requiring developers to manually verify each issue, giving attackers time to exploit any overlooked vulnerabilities. To address this, we propose COLLISIONREPAIR, an automated patching technique for mitigating storage collision risks. COLLISIONREPAIR monitors storage access sequences between proxy and logic contracts by defining an "ownership" property for storage locations. It then replays historical transactions to recover existing storage ownership, ensuring the patched code aligns with the current state. A gas impact-aware differential analysis is applied to verify the patch, distinguishing genuine behavioral changes from variations caused by gas usage. Our evaluation on 12,526 real-world vulnerable upgradeable contracts shows that COLLISIONREPAIR effectively detects and mitigates storage collision attacks without interfering with normal contract operations.

Discipline

Information Security

Areas of Excellence

Digital transformation

Publication

SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium, Seattle, USA, August 13-15

First Page

4035

Last Page

4052

Identifier

10.5555/3766078.3766286

Publisher

ACM

City or Country

New York

Additional URL

https://doi.org/10.5555/3766078.3766286

Download

Share

COinS