Quantifying the Risk of Out-of-Gas Conditions in Ethereum Smart Contracts

Abstract

Ethereum smart contracts operate with hundreds of billions of dollars, promising algorithmic fairness and guaranteed execution. But in reality, the guaranteed execution promise is often unfulfilled. For instance, a smart contract might reject the withdrawal of previously invested funds due to resource over-consumption - the condition known as running out-of-gas (OOG). In this work, we challenge the common binary perception of the OOG condition as a vulnerability, showing instead that OOG is a risk spectrum. Furthermore, we develop an API called OGRISK (Out of Gas Risk Estimator) that quantifies the OOG risk for a given smart contract. OGRISK uses a novel machine learning approach that builds a feature vector from the histogram of inter-node relationships in an augmented abstract syntax tree (AAST). Using manual expert labeling, we train a supervised model based on three discrete risk levels. Next, we develop a risk score heuristic that represents the OOG risk prediction as a scalar risk score (R -score). We apply the developed heuristic to Ethereum Mainnet contracts in the wild and discover that: 1) approximately 97.8% of smart contracts with an R-score of at least 0.9 are indeed in danger of running out of gas; 2) approximately 1.31% of all open-source smart contracts deployed on the Ethereum Mainnet have an R-score of 0.9 or higher.