BlockScope: Detecting and Investigating Propagated Vulnerabilities in Forked Blockchain Projects

Abstract

Due to the open-source nature of the blockchain ecosystem, it is common for new blockchains to fork or partially reuse the code of classic blockchains. For example, the popular Dogecoin, Litecoin, Binance BSC, and Polygon are all variants of Bitcoin/Ethereum. These "forked" blockchains thus could encounter similar vulnerabilities that are propagated from Bitcoin/Ethereum during forking or subsequently commit fetching. In this paper, we conduct a systematic study of detecting and investigating the propagated vulnerabilities in forked blockchain projects. To facilitate this study, we propose BlockScope, a novel tool that can effectively and efficiently detect multiple types of cloned vulnerabilities given an input of existing Bitcoin/Ethereum security patches. Specifically, BlockScope adopts similarity-based code match and designs a new way of calculating code similarity to cover all the syntax-wide variant (i.e., Type-1, Type-2, and Type-3) clones. Moreover, BlockScope automatically extracts and leverages the contexts of patch code to narrow down the search scope and locate only potentially relevant code for comparison.Our evaluation shows that BlockScope achieves good precision and high recall both at 91.8% (1.8 times higher recall than that in the state-of-the-art ReDeBug while with close precision). BlockScope allows us to discover 101 previously unknown vulnerabilities in 13 out of the 16 forked projects of Bitcoin and Ethereum, including 16 from Dogecoin, 6 from Litecoin, 1 from Binance BSC, and 4 from Optimism. We have reported all the vulnerabilities to their developers; 40 of them have been patched or accepted, 66 were acknowledged or under pending, and only 4 were rejected. We further investigate the propagation and patching processes of discovered vulnerabilities, and reveal three types of vulnerability propagation from source to forked projects, as well as the long delay (mostly over 200 days) for releasing patches in Bitcoin forks (vs. ∼100 days for Ethereum forks).

Advanced Persistent Threats based on Supply Chain Vulnerabilities: Challenges, Solutions and Future Directions

“…On the other hand, similarity scores can be computed at the code-level or path-level, as explored in the work by Wang et al [129], where they tackled the tracking problem among devices and calculated similarity scores between devices for tracking purposes. Similarly, Yi et al [62] compared code in forked projects with their original counterparts to identify the spread of vulnerabilities using similarity score computation.…”

“…In [62], the authors present an alternative approach to identifying propagated vulnerabilities in forked blockchain programs through the development of a tool called BlockScope. The analysis is based on patched code in original projects.…”

“…An "unofficial fork" refers to forks that are not built from official authority and may contain unauthorized changes introduced by attackers. The work by Yi [62] provides comprehensive research regarding forked projects. To mitigate this threat, the verifier side can match the provenance's source location.…”

“…The introduction of this injected code to the target system depends on user actions. Various scenarios, such as library dependencies, updates, and downloads, exist [5], [13], [52], [54], [62]. For example, users may inadvertently introduce infected versions of Python libraries as dependencies, and unverified updates might automatically install malicious code.…”