What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)?

Alex Groce; Josselin Feist; Gustavo Grieco; Michael Colburn

doi:10.1007/978-3-030-51280-4_34

What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)?

Alex Groce, Josselin Feist, Gustavo Grieco, Michael Colburn

Informatics, Computing, and Cyber Systems, School of

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

19 Scopus citations

Abstract

An important problem in smart contract security is understanding the likelihood and criticality of discovered, or potential, weaknesses in contracts. In this paper we provide a summary of Ethereum smart contract audits performed for 23 professional stakeholders, avoiding the common problem of reporting issues mostly prevalent in low-quality contracts. These audits were performed at a leading company in blockchain security, using both open-source and proprietary tools, as well as human code analysis performed by professional security engineers. We categorize 246 individual defects, making it possible to compare the severity and frequency of different vulnerability types, compare smart contract and non-smart contract flaws, and to estimate the efficacy of automated vulnerability detection approaches.

Original language	English (US)
Title of host publication	Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers
Editors	Joseph Bonneau, Nadia Heninger
Publisher	Springer
Pages	634-653
Number of pages	20
ISBN (Print)	9783030512798
DOIs	https://doi.org/10.1007/978-3-030-51280-4_34
State	Published - 2020
Event	24th International Conference on Financial Cryptography and Data Security, FC 2020 - Kota Kinabalu, Malaysia Duration: Feb 10 2020 → Feb 14 2020

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12059 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	24th International Conference on Financial Cryptography and Data Security, FC 2020
Country/Territory	Malaysia
City	Kota Kinabalu
Period	2/10/20 → 2/14/20

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-030-51280-4_34

Cite this

Groce, A., Feist, J., Grieco, G., & Colburn, M. (2020). What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)? In J. Bonneau, & N. Heninger (Eds.), Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers (pp. 634-653). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12059 LNCS). Springer. https://doi.org/10.1007/978-3-030-51280-4_34

What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)? / Groce, Alex; Feist, Josselin; Grieco, Gustavo et al.
Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers. ed. / Joseph Bonneau; Nadia Heninger. Springer, 2020. p. 634-653 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12059 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Groce, A, Feist, J, Grieco, G & Colburn, M 2020, What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)? in J Bonneau & N Heninger (eds), Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12059 LNCS, Springer, pp. 634-653, 24th International Conference on Financial Cryptography and Data Security, FC 2020, Kota Kinabalu, Malaysia, 2/10/20. https://doi.org/10.1007/978-3-030-51280-4_34

Groce A, Feist J, Grieco G, Colburn M. What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)? In Bonneau J, Heninger N, editors, Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers. Springer. 2020. p. 634-653. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-51280-4_34

Groce, Alex ; Feist, Josselin ; Grieco, Gustavo et al. / What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)?. Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers. editor / Joseph Bonneau ; Nadia Heninger. Springer, 2020. pp. 634-653 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{9d07144e89a9474db9aea63b4129090c,

title = "What are the Actual Flaws in Important Smart Contracts (And How Can We Find Them)?",

abstract = "An important problem in smart contract security is understanding the likelihood and criticality of discovered, or potential, weaknesses in contracts. In this paper we provide a summary of Ethereum smart contract audits performed for 23 professional stakeholders, avoiding the common problem of reporting issues mostly prevalent in low-quality contracts. These audits were performed at a leading company in blockchain security, using both open-source and proprietary tools, as well as human code analysis performed by professional security engineers. We categorize 246 individual defects, making it possible to compare the severity and frequency of different vulnerability types, compare smart contract and non-smart contract flaws, and to estimate the efficacy of automated vulnerability detection approaches.",

author = "Alex Groce and Josselin Feist and Gustavo Grieco and Michael Colburn",

note = "Publisher Copyright: {\textcopyright} 2020, International Financial Cryptography Association.; 24th International Conference on Financial Cryptography and Data Security, FC 2020 ; Conference date: 10-02-2020 Through 14-02-2020",

year = "2020",

doi = "10.1007/978-3-030-51280-4_34",

language = "English (US)",

isbn = "9783030512798",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "634--653",

editor = "Joseph Bonneau and Nadia Heninger",

booktitle = "Financial Cryptography and Data Security - 24th International Conference, FC 2020, Revised Selected Papers",