Security Of Smart Contracts Research Articles

TxT: Real-Time Transaction Encapsulation for Ethereum Smart Contracts

Ethereum is a permissionless blockchain ecosystem that supports execution of smart contracts, the key enablers of decentralized finance (DeFi) and non-fungible tokens (NFT). However, the expressiveness of Ethereum smart contracts is a double-edged sword: while it enables blockchain programmability, it also introduces security vulnerabilities, i.e., the exploitable discrepancies between expected and actual behaviors of the contract code. To address these discrepancies and increase the vulnerability coverage, we propose a new smart contract security testing approach called transaction encapsulation. The core idea lies in the local execution of transactions on a fully-synchronized yet isolated Ethereum node, which creates a preview of outcomes of transaction sequences on the current state of blockchain. This approach poses a critical technical challenge — the well-known time-of-check/time-of-use (TOCTOU) problem, i.e., the assurance that the final transactions will exhibit the same execution paths as the encapsulated test transactions. In this work, we determine the exact conditions for guaranteed execution path replicability of the tested transactions. To demonstrate the transaction encapsulation, we implement a transaction testing tool, TxT, which reveals the actual outcomes (either benign or malicious) of Ethereum transactions. To ensure the correctness of testing, TxT deterministically verifies whether a given sequence of transactions ensues an identical execution path on the current state of blockchain. We analyze over 1.3 billion Ethereum transactions and determine that 96.5% of them can be verified by TxT. We further show that TxT successfully reveals the suspicious behaviors associated with 31 out of 37 vulnerabilities (83.8% coverage) in the smart contract weakness classification (SWC) registry. In comparison, the vulnerability coverage of all the existing defense approaches combined only reaches 40.5%.

Survey On Vulnerabilities In Blockchain’s Smart Contracts

Trustworthy smart contracts is usually challenging due to the multifaceted semantics of essential domain-specific languages and their testability. A vulnerability in smart contracts possibly comprises numerous code-security and may allow an attacker to gain control of a system resulting in financial tribulations. Therefore, it is very essential to design safe and secure smart contracts in blockchain’s immutable environment by applying numerous techniques for assessing flaws before deployment. Application programmers building smart contracts must test their code for vulnerabilities. Security and privacy is top in the list. The objective of this research is to explore: 1) the emerging landscape of smart contracts, 2) identifies the vulnerabilities faced by the developers and 3) What tools are available to address these issues? Our study showed: 1) comprehensive realistic studies in the smart contract security are at present lagging as related to primary studies. 2) 73% of contracts implemented in Solidity had security vulnerabilities. 3) Poor programming technique and 4) Slack programming activity.

Designing secure business processes for blockchains with SecBPMN2BC

Collaborative business processes can be seen as smart contracts, as they are oftentimes adopted to express agreements among different organizations. Indeed, they provide mechanisms to formalize the obligations of each involved party. For instance, collaborative business processes can specify when a certain task should be executed, under which conditions a service should be offered to the other participants, and how physical objects and information should be manipulated. In this setting, to prevent misuse of smart contracts and services and information provided, it is paramount to guarantee by design that security requirements are fulfilled. With the rise in popularity of blockchains, several approaches exploiting the trusted smart contract execution environment offered by this technology to enforce collaborative business processes have been proposed. Yet, the complexity of business processes, security requirements, and blockchain applications calls for an engineering approach that guides the design of secure business processes. Such an approach should both take advantage of the possibilities offered by blockchain technology to enforce some security requirements (e.g., non-repudiation), and take into account the limitations blockchain poses for other security requirements (e.g., confidentiality). However, we are not aware of any existing work that aims at addressing such issues following a similar approach.In this article, we propose SecBPMN2BC: a model-driven approach to designing business processes with security requirements that are meant to be deployed on blockchains. SecBPMN2BC consists of: (i) an extension of BPMN 2.0 that allows designing secure smart contracts; (ii) a set of algorithms and their implementation that check incompatible security requirements and help the design of smart contracts; (iii) a workflow that guides the application of the method. The method has been validated with a survey conducted on security and BPMN experts.

SolSec Labs: Virtual labs for learning smart contract security

SolSec Labs is a web-based application that provides interactive training labs for blockchain developers, especially students eager to learn more about smart contract security to gain practical knowledge ( <xref ref-type="fig" rid="fig1" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fig. 1</xref> ). It teaches solidity and smart contract security skills through hands-on experience. The easy-to-understand environment enables students and early developers to immediately apply newly learned secure coding practices to their ongoing projects. Currently, it consists of a total of 10 labs crafted using examples taken from the most severe real-world vulnerabilities. Every lab teaches developers about the related vulnerability; exploitation methods; preventive and remediation measures; and, finally, a step-by-step list of lab tasks to perform to secure the presented vulnerable code.

Security and Privacy for Healthcare Blockchains

Healthcare blockchains provide an innovative way to store healthcare information, execute healthcare transactions, and build trust for healthcare data sharing and data integration in a decentralized open healthcare network environment. Although the healthcare blockchain technology has attracted broad interests and attention in industry, government and academia, the security and privacy concerns remain the focus of debate when deploying blockchains for information sharing in the healthcare sector from business operation to research collaboration. This article focuses on the security and privacy requirements for medical data sharing using blockchain, and provides a comprehensive analysis of the security and privacy risks and requirements, accompanied by technical solution techniques and strategies. First, we discuss the security and privacy requirements and attributes required for electronic medical data sharing by deploying the healthcare blockchain. Second, we categorize existing efforts into three reference blockchain usage scenarios for electronic medical data sharing, and discuss the technologies for implementing these security and privacy properties in the three categories of usage scenarios for healthcare blockchain, such as anonymous signatures, attribute-based encryption, zero-knowledge proofs, verification techniques for smart contract security. Finally, we discuss other potential blockchain application scenarios in healthcare sector. We conjecture that this survey will help healthcare professionals, decision makers, and healthcare service developers to gain technical and intuitive insights into the security and privacy of healthcare blockchains in terms of concepts, risks, requirements, development and deployment technologies and systems.

Combine sliced joint graph with graph neural networks for smart contract vulnerability detection

Combine sliced joint graph with graph neural networks for smart contract vulnerability detection

Detecting functional and security‐related issues in smart contracts: A systematic literature review

AbstractBlockchain is a platform of distributed elaboration, which allows users to provide software for a huge range of next‐generation decentralized applications without involving reliable third parties. Smart contracts (SCs) are an important component in blockchain applications: they are programmatic agreements among two or more parties that cannot be rescinded. Furthermore, SCs have an important characteristic: they allow users to implement reliable transactions without involving third parties. However, the advantages of SCs have a price. Like any program, SCs can contain bugs, some of which may also constitute security threats. Writing correct and secure SCs can be extremely difficult because, once deployed, they cannot be modified. Although SCs have been recently introduced, a large number of approaches have been proposed to find bugs and vulnerabilities in SCs. In this article, we present a systematic literature review on the approaches for the automated detection of bugs and vulnerabilities in SCs. We survey 68 papers published between 2015 and 2020, and we annotate each paper according to our classification framework to provide quantitative results and find possible areas not explored yet. Finally, we identify the open problems in this research field to provide possible directions to future researchers.

Design of an Ethereum Security Analysis for Unpredictable State System - An Overview

As a powerful tool for building framework and autonomous system across various domains, smart contracts are used to maintain security analysis in a better way. However, owing to the decentralised structure of the blockchain on which they are built, a number of concerns have surfaced about weaknesses in their programming, that according to their unique characteristics, might have (and have already had) a very large economic effect. This essay surveys the whole scope of smart contract security issues and the cutting edge of freely accessible security software.

Multi-Label Vulnerability Detection of Smart Contracts Based on Bi-LSTM and Attention Mechanism

Smart contracts are decentralized applications running on blockchain platforms and have been widely used in a variety of scenarios in recent years. However, frequent smart contract security incidents have focused more and more attention on their security and reliability, and smart contract vulnerability detection has become an urgent problem in blockchain security. Most of the existing methods rely on fixed rules defined by experts, which have the disadvantages of single detection type, poor scalability, and high false alarm rate. To solve the above problems, this paper proposes a method that combines Bi-LSTM and an attention mechanism for multiple vulnerability detection of smart contract opcodes. First, we preprocessed the data to convert the opcodes into a feature matrix suitable as the input of the neural network and then used the Bi-LSTM model based on the attention mechanism to classify smart contracts with multiple labels. The experimental results show that the model can detect multiple vulnerabilities at the same time, and all evaluation indicators exceeded 85%, which proves the effectiveness of the method proposed in this paper for multiple vulnerability detection tasks in smart contracts.

EtherFuzz: Mutation Fuzzing Smart Contracts for TOD Vulnerability Detection

With the development of Internet of Things technology, the use of Internet of Things is expanding, and its security risk will become an important factor restricting the development of Internet of Things technology. The application of blockchain technology in the security field of the Internet of Things can improve security problems, and the blockchain has immutable characteristics. Therefore, it is particularly important to ensure the security of blockchain smart contracts. However, the order of transaction in smart contracts is easy to be operated by miners, and there is a relative lack of tools to detect TOD (transaction-ordering dependent) vulnerabilities. The current smart contract vulnerability detection methods have the problems of low efficiency and low accuracy. Therefore, based on the study of TOD vulnerability principle, this paper creatively highlights a mutation fuzzy testing method EtherFuzz to specifically detect TOD vulnerability in smart contracts. Use the intelligent contract ABI (application binary interface) to generate test cases, test the byte code of the intelligent contract, use TOD to test oracle to detect TOD vulnerabilities, and then, mutate the tested data to generate new test cases. Finally, the behavior of smart contract operation is recorded, and the fuzzy test process is controlled until the vulnerability is detected. The experimental results show that when 987 token contracts are selected as Ethereum test objects, the false-positive rate, detection time overhead, and detection storage overhead of EtherFuzz are reduced by 74.4%, 30.1%, and 28.1%, respectively. Therefore, EtherFuzz has high speed, efficiency, and accuracy in detecting TOD vulnerabilities and has excellent application value.

Empirical Analysis of Vulnerabilities in Blockchain-based Smart Contracts

With the evolution of technology, blockchain a swiftly impending phenomenon i.e., "decentralized computing” is observed. The emergence of Smart Contracts (SC) has resulted in advancements in the application of blockchain technology. The Ethereum network’s computing capabilities and functionalities are founded on the basis of SC. A smart contract is a self-executing agreement between buyer and seller with the terms of the settlement between them, written directly as lines of code, existing across a distributed decentralized blockchain network. It is a decentralized software that runs on a blockchain autonomously, consistently, and publicly. Conversely, due to the complex semantics of fundamental domain-specific languages and their testability, constructing reliable and secure SC can be extremely difficult. SC might contain some vulnerabilities. Security vulnerabilities can originate from financial tribulations; there are a number of notorious events that specify blockchain SC could comprise numerous code-security vulnerabilities. Security and privacy of blockchain-based SC are very important, we must first identify their vulnerabilities before implementing them widely. Therefore, the purpose of this paper is to conduct a comprehensive experimental evaluation of two current security testing tools: Remix solidity static analysis plugin and Solium which are used for static analysis of SC. We have conducted an empirical analysis of SC for finding tangible and factual evidence, controlled by the scientific approach. The methodology’s first step is to gather all of the Ethereum SC and store them in a repository. The next step is to use the Remix solidity static analysis plugin and Solium to perform vulnerability assessments. The last step is to analyze the result of both tools and evaluate them on the basis of accuracy and effectiveness. The goal of this empirical analysis is to evaluate the two FOSS tools: Remix solidity static analysis plugin and Solium on the basis of accuracy and effectiveness. Some research questions were considered to reach the stated goal: What automated tools and frameworks are proposed in supporting the state-of-the-art empirical approach to SC vulnerability detection? How accurate are security analysis tools? And which tool has more accuracy rate? How effectively security analysis tools are detecting vulnerabilities in SC? And which is the most effective security analysis tool? We investigated the effectiveness and accuracy of security code analysis tools on Ethereum by testing them on a random sample of vulnerable contracts. The results indicate that the tools have significant discrepancies when it comes to certain security characteristics. In terms of effectiveness and accuracy, the Remix plugin outperformed and beat the other tool.

SPCBIG-EC: A Robust Serial Hybrid Model for Smart Contract Vulnerability Detection.

With countless devices connected to the Internet of Things, trust mechanisms are especially important. IoT devices are more deeply embedded in the privacy of people’s lives, and their security issues cannot be ignored. Smart contracts backed by blockchain technology have the potential to solve these problems. Therefore, the security of smart contracts cannot be ignored. We propose a flexible and systematic hybrid model, which we call the Serial-Parallel Convolutional Bidirectional Gated Recurrent Network Model incorporating Ensemble Classifiers (SPCBIG-EC). The model showed excellent performance benefits in smart contract vulnerability detection. In addition, we propose a serial-parallel convolution (SPCNN) suitable for our hybrid model. It can extract features from the input sequence for multivariate combinations while retaining temporal structure and location information. The Ensemble Classifier is used in the classification phase of the model to enhance its robustness. In addition, we focused on six typical smart contract vulnerabilities and constructed two datasets, CESC and UCESC, for multi-task vulnerability detection in our experiments. Numerous experiments showed that SPCBIG-EC is better than most existing methods. It is worth mentioning that SPCBIG-EC can achieve F1-scores of 96.74%, 91.62%, and 95.00% for reentrancy, timestamp dependency, and infinite loop vulnerability detection.

Enhancing Cloud-Based Smart Contract Security: A Hybrid AI and Optimization Approach for Vulnerability Prediction in FinTech

Enhancing Cloud-Based Smart Contract Security: A Hybrid AI and Optimization Approach for Vulnerability Prediction in FinTech

CBGRU: A Detection Method of Smart Contract Vulnerability Based on a Hybrid Model.

In the context of the rapid development of blockchain technology, smart contracts have also been widely used in the Internet of Things, finance, healthcare, and other fields. There has been an explosion in the number of smart contracts, and at the same time, the security of smart contracts has received widespread attention because of the financial losses caused by smart contract vulnerabilities. Existing analysis tools can detect many smart contract security vulnerabilities, but because they rely too heavily on hard rules defined by experts when detecting smart contract vulnerabilities, the time to perform the detection increases significantly as the complexity of the smart contract increases. In the present study, we propose a novel hybrid deep learning model named CBGRU that strategically combines different word embedding (Word2Vec, FastText) with different deep learning methods (LSTM, GRU, BiLSTM, CNN, BiGRU). The model extracts features through different deep learning models and combine these features for smart contract vulnerability detection. On the currently publicly available dataset SmartBugs Dataset-Wild, we demonstrate that the CBGRU hybrid model has great smart contract vulnerability detection performance through a series of experiments. By comparing the performance of the proposed model with that of past studies, the CBGRU model has better smart contract vulnerability detection performance.

Elipmoc: advanced decompilation of Ethereum smart contracts

Smart contracts on the Ethereum blockchain greatly benefit from cutting-edge analysis techniques and pose significant challenges. A primary challenge is the extremely low-level representation of deployed contracts. We present Elipmoc, a decompiler for the next generation of smart contract analyses. Elipmoc is an evolution of Gigahorse, the top research decompiler, dramatically improving over it and over other state-of-the-art tools, by employing several high-precision techniques and making them scalable. Among these techniques are a new kind of context sensitivity (termed “transactional sensitivity”) that provides a more effective static abstraction of distinct dynamic executions; a path-sensitive (yet scalable, through path merging) algorithm for inference of function arguments and returns; and a fully context sensitive private function reconstruction process. As a result, smart contract security analyses and reverse-engineering tools built on top of Elipmoc achieve high scalability, precision and completeness. Elipmoc improves over all notable past decompilers, including its predecessor, Gigahorse, and the state-of-the-art industrial tool, Panoramix, integrated into the primary Ethereum blockchain explorer, Etherscan. Elipmoc produces decompiled contracts with fully resolved operands at a rate of 99.5% (compared to 62.8% for Gigahorse), and achieves much higher completeness in code decompilation than Panoramix—e.g., up to 67% more coverage of external call statements—while being over 5x faster. Elipmoc has been the enabler for recent (independent) discoveries of several exploitable vulnerabilities on popular protocols, over funds in the many millions of dollars.

Key Update and Device Location of Internet of Things Based on Smart Contract

In order to reduce the key update time delay of the Internet of Things and reduce the device location error rate and location time, a new key update and device location of Internet of Things based on smart contract was designed. Adopt improved MVIF security mechanism of both parties to build smart contract security mechanism, and the key update of the Internet of Things is realized through key predistribution, user registration and login, and key update. On this basis, multidimensional scaling technology is used to abstract Internet of Things devices into relative coordinates in multidimensional space, and the absolute coordinates are obtained by eliminating the distance estimation error to achieve Internet of Things device positioning. Experimental results show that the proposed method has a lower key update time delay, a lower amount of data used in the key update process, a lower positioning error rate of Internet of Things devices, and a shorter positioning time, which fully verifies the effectiveness of the proposed method.

Smart Contract Vulnerability Detection Model Based on Multi-Task Learning.

The key issue in the field of smart contract security is efficient and rapid vulnerability detection in smart contracts. Most of the existing detection methods can only detect the presence of vulnerabilities in the contract and can hardly identify their type. Furthermore, they have poor scalability. To resolve these issues, in this study, we developed a smart contract vulnerability detection model based on multi-task learning. By setting auxiliary tasks to learn more directional vulnerability features, the detection capability of the model was improved to realize the detection and recognition of vulnerabilities. The model is based on a hard-sharing design, which consists of two parts. First, the bottom sharing layer is mainly used to learn the semantic information of the input contract. The text representation is first transformed into a new vector by word and positional embedding, and then the neural network, based on an attention mechanism, is used to learn and extract the feature vector of the contract. Second, the task-specific layer is mainly employed to realize the functions of each task. A classical convolutional neural network was used to construct a classification model for each task that learns and extracts features from the shared layer for training to achieve their respective task objectives. The experimental results show that the model can better identify the types of vulnerabilities after adding the auxiliary vulnerability detection task. This model realizes the detection of vulnerabilities and recognizes three types of vulnerabilities. The multi-task model was observed to perform better and is less expensive than a single-task model in terms of time, computation, and storage.

An Updated Survey on the Convergence of Distributed Ledger Technology and Artificial Intelligence: Current State, Major Challenges and Future Direction

In recent times, Artificial Intelligence (AI) and Distributed Ledger Technology (DLT) have become two of the most discussed sectors in Information Technology, with each having made a major impact. This has generated space for further innovation to occur in the convergence of the two technologies. In this paper, we gather, analyse, and present a detailed review of the convergence of AI and DLT in a vice versa manner. We review how AI is impacts DLT by focusing on AI-based consensus algorithms, smart contract security, selfish mining, decentralized coordination, DLT fairness, non-fungible tokens, decentralized finance, decentralized exchanges, decentralized autonomous organizations, and blockchain oracles. In terms of the impact DLT has on AI, the areas covered include AI data privacy, explainable AI, smart contract-based AIs, parachains, decentralized neural networks, Internet of Things, 5G technology and data markets, and sharing. Furthermore, we identify research gaps and discuss open research challenges in developing future directions.

Using NFTs and Blockchain for Traceability and Auctioning of Shipping Containers and Cargo in Maritime Industry

The maritime industry is a complex multi-tiered sector that plays a major role in international shipping and trade. Seaborne transportation is responsible for 90% of goods moved globally, and containerized shipments account for more than 50% of those goods. This volume of movement requires efficient tracking and traceability methods that secure the documentation process and ensure the involved stakeholders. However, due to its complexity, the maritime industry suffers from a lack of trust, lack of ownership evidence, protracted documentation procedures, and excessive data aggregation. These shortcomings are reflected in delays and elevated costs in the shipping process. To mitigate these problems, we propose in this paper a blockchain-based solution for the ownership history and traceability of shipping containers in the industry. Our solution utilizes smart contracts and non-fungible tokens (NFTs) on the Ethereum blockchain to accelerate the inefficient shipping process by digitizing ownership transfer and process documentation. Furthermore, the proposed system allows the owners to auction off their cargo in the destination ports, freeing warehouses and containers in the process. We analyze our proposed system in terms of transaction costs and smart contract security. The smart contracts are developed using the Solidity language in the Remix IDE and the code is made publicly available on GitHub.

Ethereum Smart Contract Analysis Tools: A Systematic Review

Blockchain technology and its applications are gaining popularity day by day. It is a ground-breaking technology that allows users to communicate without the need of a trusted middleman. A smart contract (self-executable code) is deployed on the blockchain and auto executes due to a triggering condition. In a no-trust contracting environment, smart contracts can establish trust among parties. Terms and conditions embedded in smart contracts will be imposed immediately when specified criteria have been fulfilled. Due to this, the malicious assailants have a special interest in smart contracts. Blockchains are immutable means if some transaction is deployed or recorded on the blockchain, it becomes unalterable. Thus, smart contracts must be analyzed to ensure zero security vulnerabilities or flaws before deploying the same on the blockchain because a single vulnerability can lead to the loss of millions. For analyzing the security vulnerabilities of smart contracts, various analysis tools have been developed to create safe and secure smart contracts. This paper presents a systematic review on Ethereum smart contracts analysis tools. Initially, these tools are categorized into static and dynamic analysis tools. Thereafter, different sources code analysis techniques are studied such as taint analysis, symbolic execution, and fuzzing techniques. In total, 86 security analysis tools developed for Ethereum blockchain smart contract are analyzed regardless of tool type and analysis approach. Finally, the paper highlights some challenges and future recommendations in the field of Ethereum smart contracts.