Smart contracts vulnerabilities: a call for blockchain software engineering?

Abstract

Smart Contracts have gained tremendous popularity in the past few years, to the point that billions of US Dollars are currently exchanged every day through such technology. However, since the release of the Frontier network of Ethereum in 2015, there have been many cases in which the execution of Smart Contracts managing Ether coins has led to problems or conflicts. Compared to traditional Software Engineering, a discipline of Smart Contract and Blockchain programming, with standardized best practices that can help solve the mentioned problems and conflicts, is not yet sufficiently developed. Furthermore, Smart Contracts rely on a non-standard software life-cycle, according to which, for instance, delivered applications can hardly be updated or bugs resolved by releasing a new version of the software. In this paper we advocate the need for a discipline of Blockchain Software Engineering, addressing the issues posed by smart contract programming and other applications running on blockchains. We analyse a case of study where a bug discovered in a Smart Contract library, and perhaps "unsafe" programming, allowed an attack on Parity, a wallet application, causing the freezing of about 500K Ethers (about 150M USD, in November 2017). In this study we analyze the source code of Parity and the library, and discuss how recognised best practices could mitigate, if adopted and adapted, such detrimental software misbehavior. We also reflect on the specificity of Smart Contract software development, which makes some of the existing approaches insufficient, and call for the definition of a specific Blockchain Software Engineering.

An Empirical Study Into the Success of Listed Smart Contracts in Ethereum

“…Only 1 out of the 25 is a well-known Dapp. 11 For the month October 2017, we were able to match 181 listed smart contracts to an unlisted contract and for October 2018 we found 103 matched pairs. Figure 3 shows for both the listed and the unlisted contracts of October 2018 the empirical Complementary Cumulative Distribution Functions (CCDFs) of the three key metrics.…”

“…Since 2017 a number of papers have been published [23], [11] with proposals for a new discipline called Blockchain Oriented Software Engineering (BOSE). The idea is that as many best practices as possible are collected and synthesized into manageable patterns and knowledge 6 .…”

Defects and Vulnerabilities in Smart Contracts, a Classification using the NIST Bugs Framework

“…The paper of Destefanis et al [22] provides a case study for the Ethereum blockchain "Parity" attack, occurring in November of 2017. The paper analyzes the source code and the library implemented, and discusses how recognized best practices could mitigate detrimental behavior in blockchain technology.…”

Laying the foundation for smart contract development: an integrated engineering process model

“…Atzei et al (2017, p. 182) point out that "a common cause of insecurity of smart contracts is the difficulty of detecting mismatches between their intended behavior and the actual one". Subsequently, Destefanis et al (2018) encouraged the academic community to further investigate and develop blockchain-oriented software engineering processes; We answer that call.…”