SolChecker: A Practical Static Analysis Framework for Ethereum Smart Contract

Abstract

Ethereum, a blockchain-based platform, provides a suitable environment for coding and executing smart contracts among trustless parties. However, smart contracts are exposed to inherent security risks due to manipulating digital units of value on a public decentralized blockchain. Even worse, vulnerabilities can hardly be fixed as the contracts are stored on the blockchain. Hence, there is a significant need to write secure and well-performing contracts and ensure their high reliability. To overcome these challenges, we propose an automated static framework SolChecker, for vulnerability detection on Solidity smart contracts. It works by analyzing information extracted from constructed abstract syntax tree of Solidity smart contracts, and developers can use the analyzed results to design detectors for specific vulnerabilities according to their needs. In this paper, we present an overview of SolChecker, provide the detailed design of each component, and evaluate the capabilities of the designed detectors on 47,037 real-world contracts. Furthermore, we clarify the effect of each extracted information by performing a comparative experiment on 500 contracts sampled from the dataset. Our tool reflects the current state of knowledge on Solidity vulnerabilities.