EOSVERIF: An Automated Analyzer for EOSIO Smart Contracts

Abstract

Compiling smart contracts into WebAssembly (WASM) bytecode format for better execution performance is becoming a common choice of many blockchain smart contract platforms, including EOSIO smart contract platform, which has been using WASM as its smart contract compilation target since its release. Similar to Ethereum smart contracts, EOSIO smart contracts have suffered from various vulnerability attacks, causing serious economic losses. Although some security analysis tools for EOSIO smart contracts have been proposed in the academic community, they still have some limitations, such as inadequate coverage of vulnerabilities and a lack of information about the triggered conditions and call stack when a vulnerability is identified. This makes it difficult for developers to utilize these tools. To address these problems, this paper proposes EOSVERIF, an automatic fine-grained analyzer of EOSIO smart contracts. It supports the concatenation of the set of vulnerabilities supported by all previous EOSIO security analysis tools and can provide the triggering conditions and execution paths of detected vulnerabilities. Our experimental results show that EOSVERIF can effectively detect vulnerabilities in EOSIO smart contracts.