{\AE}GIS: Shielding Vulnerable Smart Contracts Against Attacks

Abstract

In recent years, smart contracts have suffered major exploits, costing\nmillions of dollars. Unlike traditional programs, smart contracts are deployed\non a blockchain. As such, they cannot be modified once deployed. Though various\ntools have been proposed to detect vulnerable smart contracts, the majority\nfails to protect vulnerable contracts that have already been deployed on the\nblockchain. Only very few solutions have been proposed so far to tackle the\nissue of post-deployment. However, these solutions suffer from low precision\nand are not generic enough to prevent any type of attack.\n In this work, we introduce {\\AE}GIS, a dynamic analysis tool that protects\nsmart contracts from being exploited during runtime. Its capability of\ndetecting new vulnerabilities can easily be extended through so-called attack\npatterns. These patterns are written in a domain-specific language that is\ntailored to the execution model of Ethereum smart contracts. The language\nenables the description of malicious control and data flows. In addition, we\npropose a novel mechanism to streamline and speed up the process of managing\nattack patterns. Patterns are voted upon and stored via a smart contract, thus\nleveraging the benefits of tamper-resistance and transparency provided by the\nblockchain. We compare {\\AE}GIS to current state-of-the-art tools and\ndemonstrate that our solution achieves higher precision in detecting attacks.\nFinally, we perform a large-scale analysis on the first 4.5 million blocks of\nthe Ethereum blockchain, thereby confirming the occurrences of well reported\nand yet unreported attacks in the wild.\n