Evaluating Countermeasures for Verifying the Integrity of Ethereum Smart Contract Applications

Abstract

Blockchain technology, which provides digital security in a distributed manner, has evolved into a key technology that can build efficient and reliable decentralized applications (called DApps) beyond the function of cryptocurrency. The characteristics of blockchain such as immutability and openness, however, have made DApps more vulnerable to various security risks, and thus it has become of great significance to validate the integrity of DApps before they actually operate upon blockchain. Recently, research on vulnerability in smart contracts (a building block of DApps) has been actively conducted, and various vulnerabilities and their countermeasures were reported. However, the effectiveness of such countermeasures has not been studied well, and no appropriate methods have been proposed to evaluate them. In this paper, we propose a software tool that can easily perform comparative studies by adding existing/new countermeasures and labeled smart contract codes. The proposed tool demonstrates verification performance using various statistical indicators, which helps to identify the most effective countermeasures for each type of vulnerability. Using the proposed tool, we evaluated state-of-the-art countermeasures with 237 labeled benchmark codes. The results indicate that for certain types of vulnerabilities, some countermeasures show evenly good performance scores on various metrics. However, it is also observed that countermeasures that detect the largest number of vulnerable codes typically generate much more false positives, resulting in very low precision and accuracy. Consequently, under given constraints, different countermeasures may be recommended for detecting vulnerabilities of interest. We believe that the proposed tool could effectively be utilized for a future verification study of smart contract applications and contribute to the development of practical and secure smart contract applications.INDEX TERMS Blockchain, countermeasure, Ethereum, smart contract, vulnerability I. INTRODUCTION

Pre-deployment Analysis of Smart Contracts -- A Survey

“…and evaluate the performance of analysis tools [64,85,87,101,106,111,137,169,227]. All of these surveys focus on Ethereum smart contracts written in Solidity, except the study of Yamashita, Kazuhiro et al [227], which investigates the potential risks of Hyperledger Fabric blockchain.…”

Analyzing the Threats to Blockchain-Based Self-Sovereign Identities by Conducting a Literature Survey

“…We noticed the following inter-contractual vulnerabilities. Reentrancy vulnerability: The reentrancy vulnerability [69,76,90,101,102,104,109,114,116,117,119,120,122,125,126] describes a vulnerability, where an external callee contract calls back to a function in the caller contract before the caller contract finishes and, thereby, bypasses the due validity. One example of an attack based on the reentrancy vulnerability is the decentralized autonomous organization (DAO) attack [52,69,125].…”

Cybersecurity Risk Management Framework for Blockchain Identity Management Systems in Health IoT

“…The metric benchmarks that are covered by studies can be classified into seven groups: (1) functional [ 122 ] (in some studies called performance), in which HIoT BC-IdM are evaluated based on the primary functions that the system must perform; (2) security; (3) privacy levels [ 86 , 123 , 124 ]; (4) trust; (5) user experience [ 125 ]; (6) portability and interoperability [ 71 ]; and (7) regulation compliance metrics [ 126 ]. Moreover, some studies, such as [ 127 ], went further and proposed using a tool to evaluate the security countermeasure solutions based on security metrics. Skilled security auditors who are experts in BC-based applications are vital in the security risk management process [ 128 ].…”

“…The risk-contributing factors are classified as privacy- and security-contributing factors. Finally, six types of risk solutions are identified from the literature: (1) novel security risk management frameworks, (2) security risk assessment/risk analysis based on general risk assessment standards, (3) threat models, (4) risk analysis tools as services (static [ 111 ] or dynamic [ 107 ]), (5) solutions proposed to evaluate security risk countermeasures [ 124 , 127 ], and (6) risk penetration testing solutions.…”

“…Fraud and fraud victims classifications are given. [S103]Evaluating Countermeasures for Verifying the Integrity of Ethereum Smart Contract Applications [ 127 ] Review study including evaluation of the effectiveness of Ethereum Smart Contract vulnerability countermeasure solutions. A dynamic analysis tool to verify the integrity of SCs are proposed.…”