An Approach to Detecting Reentrancy Vulnerabilities in Interacting Smart Contracts Using Model Checking

Abstract

Blockchain-based distributed ledgers are widely adopted due to their decentralized, tamper-resistant, and trustworthy characteristics. Smart contracts, defined digitally, automatically execute contract terms and are typically composed of specific programs. These contracts manage transactions through the blockchain ledger, enabling network participants to automate transaction processes. While smart contracts are crucial in blockchain technology, their tamper-resistant and publicly accessible nature introduces significant security challenges. Notably, reentrancy vulnerabilities have led to severe incidents, such as the 2016 DAO attack, where attackers repeatedly invoked contract functions, resulting in substantial financial theft. This paper proposes a model-checking approach to detect reentrancy vulnerabilities in smart contracts. By employing Labelled Transition Systems (LTS) and Linear Temporal Logic (LTL), we can formally describe and verify smart contract behavior. We define LTL specifications for the Checks-Effects-Interactions (CEI) pattern to ensure state updates occur before any external interactions, effectively detecting reentrancy attacks.