Security Defense For Smart Contracts: A Comprehensive Survey
arXiv:2302.07347 · doi:10.1145/3593293
Abstract
The blockchain technology has been used for recording state transitions of smart contracts - decentralized applications that can be invoked through external transactions. Smart contracts gained popularity and accrued hundreds of billions of dollars in market capitalization in recent years. Unfortunately, like all other programs, smart contracts are prone to security vulnerabilities that have incurred multimillion-dollar damages over the past decade. As a result, many automated threat mitigation solutions have been proposed to counter the security issues of smart contracts. These threat mitigation solutions include various tools and methods that are challenging to compare. This survey develops a comprehensive classification taxonomy of smart contract threat mitigation solutions within five orthogonal dimensions: defense modality, core method, targeted contracts, input-output data mapping, and threat model. We classify 133 existing threat mitigation solutions using our taxonomy and confirm that the proposed five dimensions allow us to concisely and accurately describe any smart contract threat mitigation solution. In addition to learning what the threat mitigation solutions do, we also show how these solutions work by synthesizing their actual designs into a set of uniform workflows corresponding to the eight existing defense core methods. We further create an integrated coverage map for the known smart contract vulnerabilities by the existing threat mitigation solutions. Finally, we perform the evidence-based evolutionary analysis, in which we identify trends and future perspectives of threat mitigation in smart contracts and pinpoint major weaknesses of the existing methodologies. For the convenience of smart contract security developers, auditors, users, and researchers, we deploy a regularly updated comprehensive open-source online registry of threat mitigation solutions.
arXiv commentACM Computing Surveys (CSUR)
References in corpus (21)
- DEFECTCHECKER: Automated Smart Contract Defect Detection by Analyzing EVM Bytecode
- A comprehensive survey on smart contract construction and execution: paradigms, tools, and systems
- Vandal: A Scalable Security Analysis Framework for Smart Contracts
- A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses
- Towards Safer Smart Contracts: A Survey of Languages and Verification Methods
- Securing Smart Contract On The Fly
- Security Analysis Methods on Ethereum Smart Contract Vulnerabilities: A Survey
- TxT: Real-time Transaction Encapsulation for Ethereum Smart Contracts
- Generating Mock Skeletons for Lightweight Web-Service Testing
- ESCORT: Ethereum Smart COntRacTs Vulnerability Detection using Deep Neural Network and Transfer Learning
- Precise Attack Synthesis for Smart Contracts
- DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications
- SolidityCheck : Quickly Detecting Smart Contract Problems Through Regular Expressions
- EVulHunter: Detecting Fake Transfer Vulnerabilities for EOSIO's Smart Contracts at Webassembly-level
- A Survey of Smart Contract Formal Specification and Verification
- sCompile: Critical Path Identification and Analysis for Smart Contracts
- A Survey of Security Vulnerabilities in Ethereum Smart Contracts
- WANA: Symbolic Execution of Wasm Bytecode for Cross-Platform Smart Contract Vulnerability Detection
- Smart Contract Vulnerability Detection: From Pure Neural Network to Interpretable Graph Feature and Expert Pattern Fusion
- Lolisa: Formal syntax and semantics for a subset of the solidity programming language in Mathematical Tool Coq
- SAILFISH: Vetting Smart Contract State-Inconsistency Bugs in Seconds