Analyzing Ethereum Smart Contract Vulnerabilities at Scale Based on Inter-Contract Dependency

【Author】 Lyu, Qiuyun; Ma, Chenhao; Shen, Yanzhao; Jiao, Shaopeng; Sun, Yipeng; Hu, Liqin

【Source】CMES-COMPUTER MODELING IN ENGINEERING & SCIENCES

【影响因子】2.027

【Abstract】Smart contracts running on public blockchains are permissionless and decentralized, attracting both developers and malicious participants. Ethereum, the world's largest decentralized application platform on which more than 40 million smart contracts are running, is frequently challenged by smart contract vulnerabilities. What's worse, since the homogeneity of a wide range of smart contracts and the increase in inter-contract dependencies, a vulnerability in a certain smart contract could affect a large number of other contracts in Ethereum. However, little is known about how vulnerable contracts affect other on-chain contracts and which contracts can be affected. Thus, we first present the contract dependency graph (CDG) to perform a vulnerability analysis for Ethereum smart contracts, where CDG characterizes inter-contract dependencies formed by DELEGATECALL-type internal transaction in Ethereum. Then, three generic definitions of security violations against CDG are given for finding respective potential victim contracts affected by different types of vulnerable contracts. Further, we construct the CDG with 195,247 smart contracts active in the latest blocks of the Ethereum and verify the above security violations against CDG by detecting three representative known vulnerabilities. Compared to previous large-scale vulnerability analysis, our analysis scheme marks potential victim contracts that can be affected by different types of vulnerable contracts, and identify their possible risks based on the type of security violation actually occurring. The analysis results show that the proportion of potential victim contracts reaches 14.7%, far more than that of corresponding vulnerable contracts (less than 0.02%) in CDG.

【Keywords】Smart contract vulnerability; smart contract homogeneity; contract dependency graph; automated analysis

【发表时间】2023

【收录时间】2023-03-13

【文献类型】实验仿真

【主题类别】

区块链治理-技术治理-智能合约漏洞检测