Audit-Driven Signature Tracing for Smart Contract Safety
summary
Extracts reusable bytecode-level signatures from audit reports plus optional LLM or test-based summaries, publishes them as small JSON records (SPDX-like) with links to patches and proofs, and runs three signature-generation methods at scale over public onchain data (Google BigQuery) as a proof-of-concept. Uses diffs, function selectors, execution traces and small witness artifacts (Foundry tests or SMT queries) for verifiable matching, validated by GitHub Actions and exploring privacy-preserving matching (PSI) to reduce false positives.
AI-written summary · about
chapters (20)
- 0:00Audit-driven signature tracing intro
- 1:03Smart contract uniqueness
- 3:53Smart contract security risks
- 6:45Current auditing approaches
- 9:17Learning from audit reports challenges
- 10:23Automated program analysis
- 12:29LLM security analyzer limits
- 13:57Signature tracing introduction
- 16:27Generating signatures from patches
- 18:12Extracting signatures from traces
- 19:37Design-level vulnerabilities with fact cards
- 22:07JSON schema for security signatures
- 23:32Workflow for audit-driven signatures
- 24:59Core signature tracing challenges
- 25:43Fragmented audit and incident reports
- 26:46Balancing abstraction and precision
- 27:31Community-driven signature validation
- 27:55Privacy-preserving detection techniques
- 29:19Future plans and open-source
- 30:49Summary and conclusion
related talks
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
21mBeyond SBOMs and SLSA: Build Trust With Custom Attestations for End-to-End Supply Chain Security
54mFrom "Trust Me" to "Verify Me"
25mBehavioral simulation for smart contracts
30mSmart-Contract Security 201: Auditing Lessons for Solana Founders
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
15mWhy Smart Contract Audit is Not Enough
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments