Ethereum Smart Contracts: Security Vulnerabilities and Security Tools

Abstract

Ethereum represents the second generation of blockchain technology by providing\nan open and global computing platform which allows the exchange of cryptocurrency\n(Ether) and the development of self-verifying smart contract applications.\nSmart contracts present a foundation for possessing digital assets and a variety of\ndecentralized applications within the blockchain area. Ethereum and smart contracts\nare public, distributed and immutable, as such, they are prone to vulnerabilities\nsourcing from simple coding mistakes of developers.\n\nMotivated by the security breaches and recurring financial losses in smart contracts,\nwe aim to advance the field of security in smart contract programming.\nThe main objective is to aid smart contract developers by providing a taxonomy of\nall known security issues and by inspecting the security code analysis tools used\nto identify those vulnerabilities. Based on previous research as well as attacks on\nEthereum smart contracts, we propose an updated taxonomy which categorizes\nall known vulnerabilities within their architectural and severity level. Our second\nproposed taxonomy is a novel categorization of security tools on Ethereum.\n\nFurthermore, we conduct the investigation of security code analysis tools on\nEthereum by assessing their effectiveness and accuracy. In particular, we analyze\nfour security tools, namely, Oyente, Securify, Remix, and SmartCheck. The results\nindicate that there are overall inconsistencies between the tools on different security\nproperties. SmartCheck outperformed the other tools in terms of effectiveness,\nwhereas Oyente performed the best in terms of accuracy. Furthermore, based on\nthe limitations we identified, we propose future improvements within the user interfaces,\ninterpretation of results, and additional vulnerability checks.