Making Smart Contract Development More Secure and Easier

【Author】 Ren, Meng; Ma, Fuchen; Yin, Zijing; Fu, Ying; Li, Huizhong; Chang, Wanli; Jiang, Yu

【Source】PROCEEDINGS OF THE 29TH ACM JOINT MEETING ON EUROPEAN SOFTWARE ENGINEERING CONFERENCE AND SYMPOSIUM ON THE FOUNDATIONS OF SOFTWARE ENGINEERING (ESEC/FSE '21)

【Abstract】With the rapid development of distributed applications, smart contracts have attracted more and more developers' attentions. However, developers or domain experts have different levels of familiarity with specific programming languages, like Solidity, and those vulnerabilities hidden in the code would be exploited and result in huge property losses. Existing auxiliary tools lack security considerations. Most of them only provide word completion based on fuzzy search and detection services for limited types of vulnerabilities, which results in the manpower waste during coding and potential vulnerability threats after deployment. In this work, we propose an integrated framework to enhance security in the two stages of recommendation and validation, assisting developers to implement more secure contracts more quickly. First, we reinforce original smart contracts with general patch patterns and secure programming standards for training, and design a real-time code suggestion algorithm to predict secure words for selection. Then, we integrate multiple widely-used testing tools to provide validation services. For evaluation, we collected 47,398 real-world contracts, and the result shows that it outperforms existing platforms and tools, improving the average word suggestion accuracy by 30% 60% and helping detect about 25% 61% more vulnerabilities. In most cases, our framework can correctly predict next words with the probability up to 82% 97% within top ten candidates. Compared with professional vulnerability mining tools, it can find more vulnerabilities and provide targeted modification suggestions without frivolous configurations. Currently, this framework has been used as the official development tool of WeBank and integrated as the recommended platform by FISCO-BCOS community.

【Keywords】Smart Contract Development; Domain-specific Reinforcement; Integrated Testing

【发表时间】2021

【收录时间】2022-08-16

【文献类型】Proceedings Paper

【论文大主题】智能合约

【论文小主题】智能合约安全与漏洞检测