Security Analysis Methods on Ethereum Smart Contract Vulnerabilities: A Survey

Abstract

Smart contracts are software programs featuring both traditional applications\nand distributed data storage on blockchains. Ethereum is a prominent blockchain\nplatform with the support of smart contracts. The smart contracts act as\nautonomous agents in critical decentralized applications and hold a significant\namount of cryptocurrency to perform trusted transactions and agreements.\nMillions of dollars as part of the assets held by the smart contracts were\nstolen or frozen through the notorious attacks just between 2016 and 2018, such\nas the DAO attack, Parity Multi-Sig Wallet attack, and the integer\nunderflow/overflow attacks. These attacks were caused by a combination of\ntechnical flaws in designing and implementing software codes. However, many\nmore vulnerabilities of less severity are to be discovered because of the\nscripting natures of the Solidity language and the non-updateable feature of\nblockchains. Hence, we surveyed 16 security vulnerabilities in smart contract\nprograms, and some vulnerabilities do not have a proper solution. This survey\naims to identify the key vulnerabilities in smart contracts on Ethereum in the\nperspectives of their internal mechanisms and software security\nvulnerabilities. By correlating 16 Ethereum vulnerabilities and 19 software\nsecurity issues, we predict that many attacks are yet to be exploited. And we\nhave explored many software tools to detect the security vulnerabilities of\nsmart contracts in terms of static analysis, dynamic analysis, and formal\nverification. This survey presents the security problems in smart contracts\ntogether with the available analysis tools and the detection methods. We also\ninvestigated the limitations of the tools or analysis methods with respect to\nthe identified security vulnerabilities of the smart contracts.\n