Smart Contract Security: A Review with a Focus on Decentralized Finance

Abstract

Decentralized finance, or DeFi, has become the dominating application category on public blockchains like Ethereum. DeFi allows users to lend, borrow, collateralize, and exchange using smart contracts for a cheap cost of trust, unlike traditional finance. However, DeFi's openness creates a large attack surface, threatening players' funds. This paper introduces BLOCKEYE, a real-time threat detection technology for Ethereum DeFi deployments. Two essential aspects of BLOCKEYE handle this challenge: (1) Automated security analysis identifies vulnerable DeFi projects. To detect external manipulation of essential service states like asset prices, this technique uses symbolic reasoning on their data flow. (2) Offchain transaction monitor for susceptible DeFi projects. This monitor captures transactions not only for the target project but also for associated projects, providing further security analysis. BLOCKEYE alerts you to potential attacks when it detects system invariants like quick and disproportionate benefit to cost. Successfully applying BLOCKEYE to prominent DeFi projects has revealed previously unreported security attacks. The system's real-time analysis and detection improves DeFi ecosystem security, protecting user funds and decentralized financial platforms.