MSmart: Smart Contract Vulnerability Analysis and Improved Strategies Based on Smartcheck
Source abstract
Abstract
As is well known, smart contracts on the blockchain store plenty of digital assets, and these contracts deployed on the blockchain are difficult to be modified. For this reason, the analysis and detection of smart contract vulnerabilities have received extensive attention. Smartcheck, a typical Java-implemented static analysis tool of smart contracts, is capable of converting Solidity source code into path diagrams based on the lexical and syntactic analysis, and finds smart contract vulnerabilities by path matching. Although Smartcheck can analyze most of the real-world vulnerabilities, some imperceptible vulnerabilities may be ignored, causing huge economic losses. In order to address these issues, we develop a new tool named MSmart to analyze the vulnerabilities of high risk such as timestamp dependence vulnerabilities, integer overflow vulnerabilities, self-destruct vulnerabilities, etc. MSmart converts the smart contract source code into an intermediate representation, and looks for smart contract vulnerabilities based on intermediate representation and XPath rules. We add new intermediate representation rules of Smartcheck to detect more kinds of vulnerabilities and optimize existing rules to suit the complexity of smart contract. We also implemented smart contract batch detection to shorten the time it takes to find vulnerabilities. To analysis the performance of MSmart, we collect 6000 real-world contracts from Etherscan and design some comparative experiments with other tools. The results of experiment show that MSmart is able to analyze related vulnerabilities better, and false positives and false negatives have been reduced due to our improvements.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Blockchain Technology Applications and Security · Advanced Malware Detection Techniques · Security and Verification in Computing
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer and Control Engineering, Yantai University, Yantai 264005, China
Funding
The National Natural Science Foundation of China
References (39)
Show source-provided references
1. Nakamoto, S. (2022, December 10). Bitcoin: A peer-to-Peer Electronic Cash System. Available online: https://bitcoin.org/bitcoin.pdf.
2. Smart contracts: Building blocks for digital markets
3. Lauslahti, K., Juri, M., and Timo, S. (2017). Smart contracts–How will blockchain technology affect contractual practices?. Etla Rep., 68.10.2139/ssrn.3154043 ↗
4. Blockchain-enabled smart contracts: Architecture, applications, and future trends10.1109/TSMC.2019.2895123 ↗
5. Blockchain-Based Access Control Model to Preserve Privacy for Personal Health Record Systems10.1155/2019/8315614 ↗
6. Chen, J., Xia, X., Lo, D., and Yang, X. (2020). Maintaining smart contracts on Ethereum: Issues, techniques, and future challenges. arXiv.
7. (2022, December 10). FarmEOS. Available online: https://bcsec.org/indec/detail/id/456/.
8. (2022, December 10). Playgames. Available online: https://bcesc.org/index/detail/id/459/.
9. (2022, December 10). LuckBet. Available online: https://bcsec.org/index/detail/id/461/.
10. (2022, December 10). EOSlots. Available online: https//bcsec.org/index/detail/id/477/.
11. Torres, C.F., Schütte, J., and State, R. (2018, January 3–7). Osiris: Hunting for integer bugs in ethereum smart contracts. Proceedings of the 34th Annual Computer Security Applications Conference, New York, NY, USA.10.1145/3274694.3274737 ↗
12. Luu, L., Chu, D.H., Olickel, H., Olickel, H., Saxena, P., and Hobor, A. (2016, January 24–26). Making smart contracts smarter. Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, Vienna, Austria.10.1145/2976749.2978309 ↗
13. Moura, L., and Bjørner, N. (April, January 29). Z3: An efficient SMT solver. Proceedings of the International conference on Tools and Algorithms for the Construction and Analysis of Systems, Budapest, Hungary.
14. A critical-path-coverage-based vulnerability detection method for smart contracts10.1109/ACCESS.2019.2947146 ↗
15. (2022, December 10). Mythril. Available online: https://github.com/ConsenSys/mythril/.
16. A conceptual analysis10.1177/001391657600800102 ↗
17. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software
18. Jensen, T., Le, M.D., and Thorn, T. (1999, January 9–12). Verification of control flow based security properties. In Proceedings of 1999 IEEE Symposium on Security and Privacy (Cat. No. 99CB36344), Oakland, CA, USA.
19. Feist, J., Grieco, G., and Groce, A. (2019, January 27). Slither: A static analysis framework for smart contracts. Proceedings of the 2019 IEEE/ACM 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB), Montreal, QC, Canada.10.1109/WETSEB.2019.00008 ↗
20. Tikhomirov, S., Voskresenskaya, E., and Ivanitskiy, I. (2018, January 27). Smartcheck: Static analysis of ethereum smart contracts. Proceedings of the 1st International Workshop on Emerging Trends in Software Engineering for Blockchain, New York, NY, USA.10.1145/3194113.3194115 ↗
21. Buffer overflow and format string overflow vulnerabilities10.1002/spe.515 ↗
22. (2022, December 10). BeautyChain. Available online: https://etherscan.io/token/0xc5d105e63711398af9bbff092d4b6769c82f793d/.
23. Security and privacy-protection technologies in smart contract
24. Atzei, N., Bartoletti, M., and Cimoli, T. (2017, January 24–25). A survey of attacks on ethereum smart contracts (sok). Proceedings of the 2019 International Conference on Principles of Security and Trust, Uppsala, Sweden.10.1007/978-3-662-54455-6_8 ↗
25. Why do smart contracts self-destruct? investigating the selfdestruct function on ethereum
26. (2022, December 10). Parity multisig bug. Available online: https://hackingdistributed.com/2017/07/22/deep-dive-parity-bug.
27. Wang, A., Wang, H., Jiang, B., and Chen, W.K. (2020, January 28–29). Artemis: An improved smart contract verification tool for vulnerability detection. In Proceedings of 2020 7th International Conference on Dependable Systems and Their Applications (DSA), Xi’an, China.10.1109/DSA51864.2020.00031 ↗
28. Kaleem, M., Mavridou, A., and Laszka, A. (2020, January 28–30). Vyper: A security comparison with solidity based on common vulnerabilities. Proceedings of the 2020 2nd Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS), Paris, France.10.1109/BRAINS49436.2020.9223278 ↗
29. Research on vulnerability mining technique for smart contracts
30. A survey of smart contract vulnerability research
31. Gasti, P., Tsudik, G., Uzun, E., and Zhang, L. (–2, January 30). DoS and DDoS in named data networking. Proceedings of the 2013 22nd International Conference on Computer Communication and Networks (ICCCN), Nassau, Bahamas.10.1109/ICCCN.2013.6614127 ↗
32. (2022, December 10). KotET. Available online: https://www.kingoftheether.com/thrones/kingoftheether/index.html/.
33. (2022, December 10). Solidity. Available online: http://solidity.readthedocs.org/.
34. (2022, December 10). ANTLR. Available online: http://www.antlr.org/.
35. (2022, December 10). XML Path Language. Available online: https://www.w3.org/TR/xpath-3/.
36. (2022, December 10). SafeMath. Available online: https://zeppelin.tryblockchain.org/SafeMath.html/.
37. Yaish, A., Tochner, S., and Zohar, A. (2022, January 11–15). Blockchain stretching & squeezing: Manipulating time for your best interest. Proceedings of the 23rd ACM Conference on Economics and Computation, New York, NY, USA.10.1145/3490486.3538250 ↗
38. (2022, December 10). Etherscan. Available online: https://etherscan.io/.
39. (2022, December 10). Smartbugs. Available online: https://github.com/smartbugs/.