Smart Contract Vulnerabilities: Vulnerable Does Not Imply Exploited

Abstract

In recent years, we have seen a great deal of both academic and practical interest in the topic of vulnerabilities in smart contracts, particularly those developed for the Ethereum blockchain. While most of the work has focused on detecting *vulnerable* contracts, in this paper, we focus on finding how many of these vulnerable contracts have actually been *exploited*. We survey the 23,327 vulnerable contracts reported by six recent academic projects and find that, despite the amounts at stake, only 1.98% of them have been exploited since deployment. This corresponds to at most 8,487 ETH (~1.7 million USD), or only 0.27% of the 3 million ETH (600 million USD) at stake. We explain these results by demonstrating that the funds are very concentrated in a small number of contracts which are *not exploitable* in practice.

arXiv commentto appear at USENIX Security 2021

References in corpus (3)

• ContractFuzzer: Fuzzing Smart Contracts for Vulnerability Detection
• Vandal: A Scalable Security Analysis Framework for Smart Contracts
• Towards Safer Smart Contracts: A Survey of Languages and Verification Methods

Cited by in corpus (7)

• A comprehensive survey on smart contract construction and execution: paradigms, tools, and systems
• SmartBugs: A Framework to Analyze Solidity Smart Contracts
• Maintaining Smart Contracts on Ethereum: Issues, Techniques, and Future Challenges
• BlockScope: Detecting and Investigating Propagated Vulnerabilities in Forked Blockchain Projects
• A Survey of Smart Contract Formal Specification and Verification
• Flash Crash for Cash: Cyber Threats in Decentralized Finance
• TokenHook: Secure ERC-20 smart contract