Move Smart Contract Vulnerability Detection based on Resource-flow Analysis

Abstract

The Move smart contract (MSC) is designed to enhance the type security of digital assets by utilizing a resource-based structure. However, vulnerabilities may be introduced during the development process. In response to the security threats faced by digital assets in the MSC, we have identified five resource-related vulnerabilities for the first time. Additionally, we have defined two test oracles and proposed a method to detect these vulnerabilities in the MSC using resource-flow analysis. Our method begins by analyzing the resource types present in the MSC. Based on the resource operation information within the contract function, we create a resource-flow graph. Next, the resource-flows are derived from the Resource-Flow Graph using a traversal algorithm, and they are then transformed into test cases. In the final step, the generated test cases are executed, and the vulnerabilities are detected by utilizing the proposed test oracles. Through a comprehensive case study, we showcase the various resource-related vulnerabilities and assess the feasibility of our method in detecting these vulnerabilities. The results demonstrate that our proposed method is effective in identifying resource-related vulnerabilities.