Vandal: A Scalable Security Analysis Framework for Smart Contracts

Abstract

The rise of modern blockchains has facilitated the emergence of smart contracts: autonomous programs that live and run on the blockchain. Smart contracts have seen a rapid climb to prominence, with applications predicted in law, business, commerce, and governance.Smart contracts are commonly written in a high-level language such as Ethereum's Solidity, and translated to compact low-level bytecode for deployment on the blockchain. Once deployed, the bytecode is autonomously executed, usually by a virtual machine. As with all programs, smart contracts can be highly vulnerable to malicious attacks due to deficient programming methodologies, languages, and toolchains, including buggy compilers. At the same time, smart contracts are also high-value targets, often commanding large amounts of cryptocurrency. Hence, developers and auditors need security frameworks capable of analysing low-level bytecode to detect potential security vulnerabilities.In this paper, we present Vandal: a security analysis framework for Ethereum smart contracts. Vandal consists of an analysis pipeline that converts low-level Ethereum Virtual Machine (EVM) bytecode to semantic logic relations. Users of the framework can express security analyses in a declarative fashion: a security analysis is expressed in a logic specification written in the Soufflé language. We conduct a large-scale empirical study for a set of common smart contract security vulnerabilities, and show the effectiveness and efficiency of Vandal. Vandal is both fast and robust, successfully analysing over 95% of all 141k unique contracts with an average runtime of 4.15 seconds; outperforming the current state of the art tools-Oyente, EthIR, Mythril, and Rattle-under equivalent conditions.

On the Just-In-Time Discovery of Profit-Generating Transactions in DeFi Protocols

“…We perform systematic path exploration to determine if the model (cf. Section III) satisfies the provided requirements, similar to other model checking systems [13], [16], [36], [43], [45], [48], [56], [57].…”

Targeting the Weakest Link: Social Engineering Attacks in Ethereum Smart Contracts

“…Moreover, a recent analysis of 420 million Ethereum transactions by Zhou et al reveals an ongoing evolution of vulnerabilities and attacks in smart contracts [24]. To avoid devastating consequences of smart contract hacks, a number of security auditing tools have been developed to detect smart contract vulnerabilities [4,5,14,21], such as reentrancy, integer overflow, etc., most of which are smart contract code vulnerabilities. However, smart contracts are designed and implemented by human developers to interact with human users, in which the human is the central component of a smart contract ecosystem.…”

“…These smart contracts are considered to be the de-facto standardized implementations of popular smart contract code patterns. The OpenZeppelin project provides a rich codebase for ERC-20 token developers 4 . EIP-55 Checksums.…”

“…4 : All Ethereum accounts are equally secure as long as their private keys are random and secret. In Section 4.1.3, we show that a small portion of Ethereum accounts have a special property, making them more vulnerable to a specific social engineering attack.…”

“…https://nick-ivanov.github.io/se-info/2 Each fungible token has the same value and does not possess any special characteristics compared with other tokens of the same type 3. https://eips.ethereum.org/EIPS/eip-204 https://openzeppelin.com/contracts/ 5 https://eips.ethereum.org/EIPS/eip-556 An implementation of this function, named generateAddress, can be found at https://github.com/ethereumjs/ethereumjs-util.…”