  The increased adoption of smart contracts in many industries has made them an
attractive target for cybercriminals, leading to millions of dollars in losses.
Thus, deploying smart contracts with detected vulnerabilities (known to
developers) are not acceptable, and fixing all the detected vulnerabilities is
needed, which incurs high manual labor cost without effective tool support. To
fill this need, in this paper, we propose ContractFix, a novel framework that
automatically generates security patches for vulnerable smart contracts.
ContractFix is a general framework that can incorporate different fix patterns
for different types of vulnerabilities. Users can use it as a security fix-it
tool that automatically applies patches and verifies the patched contracts
before deploying the contracts. To address the unique challenges in fixing
smart contract vulnerabilities, given an input smart contract, \tool conducts
our proposed ensemble identification based on multiple static verification
tools to identify vulnerabilities that are amenable for automatic fix. Then,
ContractFix generates patches using template-based fix patterns and conducts
program analysis (program dependency computation and pointer analysis) for
smart contracts to accurately infer and populate the parameter values for the
fix patterns. Finally, ContractFix performs static verification that guarantees
the patched contract is free of vulnerabilities. Our evaluations on $144$ real
vulnerable contracts demonstrate that \tool can successfully fix $94\%$ of the
detected vulnerabilities ($565$ out of $601$) and preserve the expected
behaviors of the smart contracts.
