What are the Actual Flaws in Important Smart Contracts (and How Can We\n Find Them)?

Abstract

An important problem in smart contract security is understanding the\nlikelihood and criticality of discovered, or potential, weaknesses in\ncontracts. In this paper we provide a summary of Ethereum smart contract audits\nperformed for 23 professional stakeholders, avoiding the common problem of\nreporting issues mostly prevalent in low-quality contracts. These audits were\nperformed at a leading company in blockchain security, using both open-source\nand proprietary tools, as well as human code analysis performed by professional\nsecurity engineers. We categorize 246 individual defects, making it possible to\ncompare the severity and frequency of different vulnerability types, compare\nsmart contract and non-smart contract flaws, and to estimate the efficacy of\nautomated vulnerability detection approaches.\n