Smart Contract Development: Challenges and Opportunities

One of the building blocks of our legal and economic systems in society is the indispensable reliance on contracts and trust systems to protect individual rights. Recently smart contracts are becoming prominent parts of various blockchain platforms. The goal of smart contracts is to eliminate the third party and centralized trust systems. Due to recent emergence of smart contracts, there is no well-defined framework that researchers can use to evaluate smart contracts under various blockchain platforms and differentiate between them. In this work, a survey on the prominent smart contract landscape specially those based on blockchain have been conducted. Based on the survey, an evaluation framework to assess smart contracts has been proposed. The framework is a set of criteria based on two major aspects; infrastructure related and development related criteria. The evaluation framework was peer-reviewed for reliability and validity. To measure the applicability of the proposed framework, it has been used to empirically evaluate some of the most prominent smart contract platforms. The results of the empirical evaluation have shown that the Ethereum blockchain smart contract exceeds the others in terms of development tools, resources, and community support. EOS blockchain smart contracts have the best execution speeds, and transaction costs. Lastly, Stellar blockchain has predictability and the best transaction builder to use in smart contract development concerning user friendliness. Recommendations for smart contract developers are provided in light of the research.

iContractML 2.0: A domain-specific language for modeling and deploying smart contracts onto multiple blockchain platforms

Ethereum is a blockchain platform that hosts and executes smart contracts. Smart contracts have been used to implement cryptocurrencies and crowdfunding initiatives (ICOs). A major concern in Ethereum is the security of smart contracts. Different from traditional software development, smart contracts are immutable once deployed. Hence, vulnerabilities and bugs in smart contracts can lead to catastrophic financial loses. In order to avoid taking the risk of writing buggy code, smart contract developers are encouraged to reuse pieces of code from reputable sources (e.g., OpenZeppelin). In this paper, we study code cloning in Ethereum. Our goal is to quantify the amount of clones in Ethereum (RQ1), understand key characteristics of clone clusters (RQ2), and determine whether smart contracts contain pieces of code that are identical to those published by OpenZeppelin (RQ3). We applied Deckard, a tree-based clone detector, to all Ethereum contracts for which the source code was available. We observe that developers frequently clone contracts. In particular, 79.2% of the studied contracts are clones and we note an upward trend in the number of cloned contracts per quarter. With regards to the characteristics of clone clusters, we observe that: (i) 9 out of the top-10 largest clone clusters are token managers, (ii) most of the activity of a cluster tends to be concentrated on a few contracts, and (iii) contracts in a cluster to be created by several authors. Finally, we note that the studied contracts have different ratios of code blocks that are identical to those provided by the OpenZeppelin project. Due to the immutability of smart contracts, as well as the impossibility of reverting transactions once they are deemed final, we conclude that the aforementioned findings yield implications to the security, development, and usage of smart contracts.

Blockchain smart contracts can support the decentralisation of business processes, but due to smart contracts’ specifics, their development is a complicated process. Introducing model-driven development principles in smart contract development can facilitate requirement specification, design, and implementation activities. This paper presents a model-driven development method MDAsmartCD (Model-Driven Architecture-based Smart Contract Development) to alleviate smart contract development by supporting the complete MDA life cycle, covering the definition of Computation-Independent Model, Platform-Independent Model, and two instances of Platform-Specific Models. In MDAsmartCD, model transformations (model-to-model and model-to-text) are used to produce smart contract code in the Hyperledger Fabric platform Go and the Ethereum platform Solidity programming languages. The method application was demonstrated by implementing the smart contract for the hackathon solution and executing the generated Solidity and Go smart contracts in the workflow of issuing certificates for hackathon participants. During the execution of the workflow, both deployed smart contracts behaved identically and recorded analogous results in respective blockchain data storages. This demonstrated that the MDAsmartCD method enables the generation of compilable and executable smart contract code, ready for deployment on a blockchain platform.

Recently, smart contracts are increasingly gaining more attention from academia and industries, due to their potential of increasing efficiency in various application domains. However, building syntactically correct smart contracts is very complex and challenging for non-expert programmers. Besides, as smart contracts are still in the early emerging phase, there is a lack of expertise and tools for supporting practitioners to teach or learn smart contract development. In this paper, we introduce SmartBuilder, a block-based visual programming framework for building smart contracts using extended Google Blockly libraries. It allows Hyperledger Fabric smart contract (also known as Chaincode) development learners or non-expert users to build smart contracts using visual blocks without writing a single code. Moreover, it is a useful and efficient educational tool for teaching or learning how to build smart contracts.

Smart contracts are a means of facilitating, verifying and enforcing digital agreements. Blockchain technology, which includes an inherent consensus mechanism and programming languages, enables the concept of smart contracts. However, smart contracts written in an existing language, such as Solidity, Vyper, and others, are difficult for domain stakeholders and programmers to understand in order to develop code efficiently and without error, owing to a conceptual gap between the contractual provisions and the respective code. Our study addresses the problem by creating smart legal contract markup language (SLCML), an XML-based smart-contract language with pattern and transformation rules that automatically convert XML code to the Solidity language. In particular, we develop an XML schema (SLCML schema) that is used to instantiate any type of business contract understandable to IT and non-IT practitioners and is processed by computers. To reduce the effort and risk associated with smart contract development, we advocate a pattern for converting SLCML contracts to Solidity smart contracts, a smart contractual oriented computer language. We exemplify and assess our SLCML and transformation approach by defining a dairy supply chain contract based on real-world data.

Blockchain-based distributed computing platforms enable the trusted execution of computation—defined in the form of smart contracts—without trusted agents. Smart contracts are envisioned to have a variety of applications, ranging from financial to IoT asset tracking. Unfortunately, the development of smart contracts has proven to be extremely error prone. In practice, contracts are riddled with security vulnerabilities comprising a critical issue since bugs are by design non-fixable and contracts may handle financial assets of significant value. To facilitate the development of secure smart contracts, we have created the FSolidM framework, which allows developers to define contracts as finite state machines (FSMs) with rigorous and clear semantics. FSolidM provides an easy-to-use graphical editor for specifying FSMs, a code generator for creating Ethereum smart contracts, and a set of plugins that developers may add to their FSMs to enhance security and functionality.

Solana is a blockchain platform with its own token, called SOL or Solana. As a blockchain network, Solana is a de-centralized public ledger for verifying and recording transactions. The Solana blockchain has smart contract capabilities. Unlike other blockchains, such as Ethereum, there is no repository or tool where to check for the source code of the smart contracts stored in the blockchain. These tools are crucial to increase the users' trust in this type of technology. Indeed, one of the most important features of the blockchain is transparency, i.e. the possibility to see the source code of the program to use, or in which the users wish to invest. However, in the blockchains that support smart contracts, what is stored is not the source code of the smart contract written in a high-level program understandable to humans, but the bytecode, i.e. a low-level code made for the hardware to be executed. For some blockchains, such as Ethereum, there are different tools, such as integrated development environment (IDE), that allow to verify that the smart contracts' source code corresponds to the bytecode installed on the nodes of the blockchain. Moreover, there are different repositories that collect smart contracts written in a high-level programming language and their corresponding bytecode. However, for the Solana blockchain, all these tools do not exist yet. The study proposes a web tool that allows verifying the ownership of a smart contract, i. e. the smart contracts' source code written in a high-level programming language corresponds to the bytecode deployed in the Solana blockchain. Moreover, we have published smart contracts' source code written in high-level programming via a public service that can be used by researchers, smart contract developers, and blockchain not-expert users.

A systematic literature review of blockchain and smart contract development: Techniques, tools, and open challenges

Software development is a very broad activity that captures the entire life cycle of a software, which includes designing, programming, maintenance and so on. In this study, we focus on the maintenance-related concerns of the post-deployment of smart contracts. Smart contracts are self-executed programs that run on a blockchain. They cannot be modified once deployed and hence they bring unique maintenance challenges compared to conventional software. According to the definition of ISO/IEC 14764, there are four kinds of software maintenance, i.e., corrective, adaptive, perfective, and preventive maintenance. This study aims to answer (i) What kinds of issues will smart contract developers encounter for corrective, adaptive, perfective, and preventive maintenance after they are deployed to the Ethereum? (ii) What are the current maintenance-related methods used for smart contracts? To obtain the answers to these research questions, we first conducted a systematic literature review to analyze 131 smart contract related research papers published from 2014 to 2020. Since the Ethereum ecosystem is fast-growing, some results from previous publications might be out-of-date and there may be a gap between academia and industry. To address this, we performed an online survey of smart contract developers on Github to validate our findings and received 165 useful responses. Based on the survey feedback and literature review, we present the first empirical study on smart contract maintenance-related concerns. Our study can help smart contract developers better maintain their smart contract-based projects, and we highlight some key future research directions to improve the Ethereum ecosystem.

As blockchain technology advances, so has the deployment of smart contracts on blockchain platforms, making it exceedingly challenging for users to explicitly identify application services. Unlike traditional contracts, smart contracts are not written in a natural language, making it difficult to determine their provenance. Automatic classification of smart contracts offers blockchain users keyword-based contract queries and a streamlined effective management of smart contracts. In addition, the advancement in smart contracts is accompanied by security challenges, which are generally caused by domain-specific security breaches in smart contract implementation. The development of secure and reliable smart contracts can be extremely challenging due to domain-specific vulnerabilities and constraints associated with various business logics. Accordingly, contract classification based on the application domain and the transaction context offers greater insight into the syntactic and semantic properties of that class. However, despite initial attempts at classifying Ethereum smart contracts, there has been no research on the identification of smart contracts deployed in transactive energy systems for energy exchange purposes. In this article, in response to the widely recognized prospects of blockchain-enabled smart contracts towards an economical and transparent energy sector, we propose a methodology for the detection and analysis of energy smart contracts. First, smart contracts are parsed by transforming code elements into vectors that encapsulate the semantic and syntactic characteristics of each term. This generates a corpus of annotated text as a balanced, representative collection of terms in energy contracts. The use of a domain corpus builder as an embedding layer to annotate energy smart contracts in conjunction with machine learning models results in a classification accuracy of 98.34%. Subsequently, a source code analysis scheme is applied to identified energy contracts to uncover patterns in code segment distribution, predominant adoption of certain functions, and recurring contracts across the Ethereum network.

With the wide application of smart contracts in many fields, the number, types, and complexity of smart contracts are showing a rapidly increasing trend. However , the development of smart contracts has its own unique programming language and security requirements, which are difficult for conventional software personnel to adapt to quickly, and how to realize the efficient development of smart contracts according to the application requirements is an important issue that needs to be solved for its further development. To this end, this paper proposes a smart contract generation method based on AST-LSTM characterization and code annotation tuning large language model, which adopts AST-LSTM model combining Abstract Syntax Tree (AST) and Tree-LSTM to vectorize the code as well as Sentence-Bert to vectorize the annotations and carry out a weighted analysis, and constructs a smart contract clustering analysis model to achieve accurate clustering of functionally similar smart contracts. Then the AST-LSTM+Transformer model is used to detect defects in the clustered code and correlate the related annotation information to construct a diverse Prompt feature prompt statement dataset. Finally, the LLaMA2-7B model is used as the basis for demand-specific smart contract generation with the help of Lora and P-Tuning v2 fine-tuning techniques. In this paper, with the help of BLEU, an auxiliary tool for bilingual translation quality assessment, and Mythril, VaaS, 1 and other code security detection tools, we conducted comparative experiments with existing methods. The results of the experiment show that the average value of BLEU of the code generated by this paper’s method is improved by about 25%, and the code security is improved by about 9%, which will greatly promote the rapid development and exploitation of smart contracts with high-security requirements.

The Ethereum blockchain allows, through software called smart contract, to automate the contract execution between multiple parties without requiring a trusted middle party. However, smart contracts are vulnerable to attacks. Tools and programming practices are available to support the development of secure smart contracts. These approaches are effective to mitigate the smart contract vulnerabilities, but the unsophisticated ecosystem of the smart contract prevents these approaches from being foolproof. Besides, the Blockchain immutability does not allow smart contracts deployed in the Blockchain to be updated. Thus, businesses and developers would develop new contracts if vulnerabilities were detected in their smart contracts deployed in Ethereum, which would imply new costs for the business. To support developers and businesses in the smart contract security decision makings, we investigate the applicability of the security code metric from non-blockchain into the smart contract domain. We use the Goal Question Metric (GQM) approach to analyze the applicability of these metrics into the smart contract domain based on metric construct and measurement. As a result, we found 15 security code metrics that can be applied to smart contract development.KeywordsSecurityMetricQGMSmart contractEthereumBlockchain

Blockchain is increasingly revolutionizing a variety of sectors, from finance to healthcare. Indeed, the availability of public blockchain platforms, such as Ethereum, has stimulated the development of hundreds of decentralized apps (dApps) that combine smart contract(s) and a front-end user interface. Smart contracts are software, as well, and, as traditional software, they require to be developed and maintained or evolved. Among all the quality properties that must be assessed and guaranteed, readability is a key aspect of source code: a highly readable code facilitates its maintainability, portability, and reusability. This is especially true when considering smart contracts, where code reuse is widely adopted. Indeed, smart contract developers often integrate code portions from other smart contracts in their artifacts. To help developers and researchers more easily estimating and monitoring the code readability of smart contracts, in this demo, we present iSCREAM. iSCREAM automatically inspects Solidity smart contracts and computes a set of metrics that previous research demonstrated being related to code readability. We evaluated iSCREAM on 90 real-world smart contract functions, showing that our tool correctly computes all the aforementioned metrics. Demo webpage: https://github.com/mfredella/iSCREAM

The adoption of blockchain based distributed ledgers is growing fast due to their ability to provide reliability, integrity, and auditability without trusted entities. One of the key capabilities of these emerging platforms is the ability to create self-enforcing smart contracts. However, the development of smart contracts has proven to be error-prone in practice, and as a result, contracts deployed on public platforms are often riddled with security vulnerabilities. This issue is exacerbated by the design of these platforms, which forbids updating contract code and rolling back malicious transactions. In light of this, it is crucial to ensure that a smart contract is secure before deploying it and trusting it with significant amounts of cryptocurrency. To this end, we introduce the VeriSolid framework for the formal verification of contracts that are specified using a transition-system based model with rigorous operational semantics. Our model-based approach allows developers to reason about and verify contract behavior at a high level of abstraction. VeriSolid allows the generation of Solidity code from the verified models, which enables the correct-by-design development of smart contracts.