Rethinking of Reentrancy on the Ethereum

Abstract

Smart contract is one of the key technologies of the blockchain and is becoming more and more popular. But at the same time, the economic losses caused by the vulnerabilities of smart contracts have also emerged in recent years. One of the most famous smart contract security issues is reentrancy. There have been many related reports and researches on reentrancy. However, the existing methods only pay attention to offensive reentrancy one-sidedly, but do not conduct a systematic and comprehensive analysis of reentrancy and some existing reentrant detection methods for smart contracts often have high false positives(FPs). We proposed a more accuracy and comprehensive detection and analysis method of reentrancy from real Ethereum transactions. In general, we used Datalog-based formulation to detect reentrant transactions in real world of Ethereum, and compared the detection results with other tools. We finally detected 2,712 reentrant transactions and 10 vulnerable smart contracts with zero false positive, furthermore, we found that many vulnerable contracts detected by other tools did not trigger real reentrant transactions. We summarized the problems in the existing detection tools and gave effective preventive measures. In addition, we also analyzed the detected benign reentrancy to further confirm the above findings, and the discovery that benign reentrancy also has its certain application scenario.