SmartCheck static analysis of ethereum smart contracts

Ethereum is a major blockchain-based platform for smart contracts - Turing complete programs that are executed in a decentralized network and usually manipulate digital units of value. Solidity is the most mature high-level smart contract language. Ethereum is a hostile execution environment, where...

Celý popis

Uložené v:
Podrobná bibliografia
Vydané v:2018 IEEE ACM 1st International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB) s. 9 - 16
Hlavní autori: Tikhomirov, Sergei, Voskresenskaya, Ekaterina, Ivanitskiy, Ivan, Takhaviev, Ramil, Marchenko, Evgeny, Alexandrov, Yaroslav
Médium: Konferenčný príspevok..
Jazyk:English
Vydavateľské údaje: New York, NY, USA ACM 27.05.2018
Edícia:ACM Conferences
Predmet:
bug detection
Computer bugs
Computer hacking
Contracts
Ethereum
smart contracts
Solidity
Static analysis
static analysis
ethereum
bug detection
smart contracts
solidity
ISBN:9781450357265, 1450357261
On-line prístup:Získať plný text
Tagy: Pridať tag
Žiadne tagy, Buďte prvý, kto otaguje tento záznam!
Popis
Shrnutí:Ethereum is a major blockchain-based platform for smart contracts - Turing complete programs that are executed in a decentralized network and usually manipulate digital units of value. Solidity is the most mature high-level smart contract language. Ethereum is a hostile execution environment, where anonymous attackers exploit bugs for immediate financial gain. Developers have a very limited ability to patch deployed contracts. Hackers steal up to tens of millions of dollars from flawed contracts, a well-known example being "The DAO", broken in June 2016. Advice on secure Ethereum programming practices is spread out across blogs, papers, and tutorials. Many sources are outdated due to a rapid pace of development in this field. Automated vulnerability detection tools, which help detect potentially problematic language constructs, are still underdeveloped in this area. We provide a comprehensive classification of code issues in Solidity and implement SmartCheck - an extensible static analysis tool that detects them1. SmartCheck translates Solidity source code into an XML-based intermediate representation and checks it against XPath patterns. We evaluated our tool on a big dataset of real-world contracts and compared the results with manual audit on three contracts. Our tool reflects the current state of knowledge on Solidity vulnerabilities and shows significant improvements over alternatives. SmartCheck has its limitations, as detection of some bugs requires more sophisticated techniques such as taint analysis or even manual audit. We believe though that a static analyzer should be an essential part of contract developers' toolbox, letting them fix simple bugs fast and allocate more effort to complex issues.
ISBN:9781450357265
1450357261
DOI:10.1145/3194113.3194115