Semantic Understanding of Smart Contracts: Executable Operational Semantics of Solidity

Jiao, Jiao; Kan, Shuanglong; Lin, Shang-Wei; Sanán, David; Liu, Yang; Sun, Jun

doi:10.1109/sp40000.2020.00066

Cited by 56 publications

(29 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Formal analysis, as an important tool of blockchain security analysis, has become quite mature. J Jiao et al 19 designed a formal specification for Ethereum smart contract to define semantic-level security attributes for advanced verification. Gleb Naumenko et al 20 designed a new transaction propagation protocol for bitcoin, which improved the security of bitcoin network.…”

Section: Related Workmentioning

confidence: 99%

Attack and protection schemes on fabric isomorphic crosschain systems

Lv¹,

Yang³

et al. 2022

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

Crosschain solves the problem of value transfer and asset interaction between different blockchains with different consensus mechanisms, or different infrastructures. It not only realizes the mutual communication of multiple independent blockchains, but also ensures the data consistency. However, existing crosschain technologies like notary mechanism, hash locking, distributed private key control, and sidechain/relaychain have potential vulnerabilities, resulting in different kinds of attacks. For example, some vulnerabilities that only exist in a blockchain like DDOS, overflow, double-spending, and so on, may have an impact on another secure blockchain due to the openness of the crosschain system. Even if all blockchains are safe enough, the security of the crosschain system cannot be guaranteed, and there are still many loopholes in the process of crosschain, which affect all blockchains. The security of crosschain has emerged as an important issue. In this work, based on BitXHub, an open-source project of crosschain, we are motivated to study the security of Fabric isomorphic crosschain system. First, we analyze the vulnerabilities in different layers of Fabric isomorphic crosschain systems, and discuss the principles of different kinds of attacks. Based on the principles, we discover and define five new crosschain attacks, including crosschain integer overflow attack, crosschain transaction forgery attack, crosschain transaction replay attack, crosschain transaction sequence attack, and crosschain routing attack. Second, we implement all the five attacks, and indicate the applicable scenarios and the boundary conditions in which each attack may occur. Third, we propose five schemes to prevent the corresponding attacks and evaluate the effectiveness of the protection schemes. We comprehensively discuss and analyze the schemes of attacks and their corresponding prevention toward Fabric isomorphic crosschain systems.

show abstract

Section: Related Workmentioning

confidence: 99%

Attack and protection schemes on fabric isomorphic crosschain systems

Lv¹,

Yang³

et al. 2022

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

show abstract

“…The more general goal of verifying smart contracts in various senses has become too big an industry to survey here [31]. Jiao et al [23] and Ribeiro et al [28] verify programs written in a subset of Solidity with respect to a high-level description of the semantics, and Bhargavan et al [11] verify smart contracts written in Solidity by translating them to F ★ . Annenkov et al [6] provide means of defining and verifying smart contracts in Coq and then extracting code for various blockchain platforms.…”

Section: Related Workmentioning

confidence: 99%

A verified algebraic representation of cairo program execution

Avigad

Goldberg

Levit

et al. 2022

Proceedings of the 11th ACM SIGPLAN International Conference on Certified Programs and Proofs

View full text Add to dashboard Cite

Cryptographic interactive proof systems provide an efficient and scalable means of verifying the results of computation on blockchain. A prover constructs a proof, off-chain, that the execution of a program on a given input terminates with a certain result. The prover then publishes a certificate that can be verified efficiently and reliably modulo commonly accepted cryptographic assumptions. The method relies on an algebraic encoding of execution traces of programs. Here we report on a verification of the correctness of such an encoding of the Cairo model of computation with respect to the STARK interactive proof system, using the Lean 3 proof assistant.

show abstract

“…In this work, we adopt and extend the K semantics for Java [24] and Solidity [34,44] to implement SpecTest. The K semantics for Solidity, called KSolidity, has currently 304 rules.…”

Section: The Oraclementioning

confidence: 99%

“…As seed programs, we used existing tests cases of K-Java [24] and KSolidity [34,44]. KSolidity is still under development, which means that we could not test all features or a large set of contracts, but it was already sufficiently developed to support many interesting cases.…”

Section: Test Settingmentioning

confidence: 99%

See 1 more Smart Citation

SpecTest: Specification-Based Compiler Testing

Schumi

Sun

2021

Fundamental Approaches to Software Engineering

Self Cite

View full text Add to dashboard Cite

Compilers are error-prone due to their high complexity. They are relevant for not only general purpose programming languages, but also for many domain specific languages. Bugs in compilers can potentially render all programs at risk. It is thus crucial that compilers are systematically tested, if not verified. Recently, a number of efforts have been made to formalise and standardise programming language semantics, which can be applied to verify the correctness of the respective compilers. In this work, we present a novel specification-based testing method named SpecTest to better utilise these semantics for testing. By applying an executable semantics as test oracle, SpecTest can discover deep semantic errors in compilers. Compared to existing approaches, SpecTest is built upon a novel test coverage criterion called semantic coverage which brings together mutation testing and fuzzing to specifically target less tested language features. We apply SpecTest to systematically test two compilers, i.e., the Java compiler and the Solidity compiler. SpecTest improves the semantic coverage of both compilers considerably and reveals multiple previously unknown bugs.

show abstract

Semantic Understanding of Smart Contracts: Executable Operational Semantics of Solidity

Cited by 56 publications

References 41 publications

Attack and protection schemes on fabric isomorphic crosschain systems

Attack and protection schemes on fabric isomorphic crosschain systems

A verified algebraic representation of cairo program execution

SpecTest: Specification-Based Compiler Testing

Contact Info

Product

Resources

About