Support for the safety of EVM bytecode via function-call interceptor

Abstract

Security problems in smart contracts are considered critical, because they are usually implemented in the field of financial services, such as cryptocurrency management. Although numerous solutions have been proposed recently, most of these are dedicated to the vulnerabilities of the source code of smart contracts before they are deployed and cannot cover runtime security issues. For instance, the deployment of vulnerable smart contracts on Ethereum block chains could cause serious damage at runtime, because contracts deployed on block chains are indestructible and are freely used later in the public domain. In addition, smart contracts are deployed in bytecode, a form that is naturally not human-readable, and thus, users fail to perceive their vulnerabilities. In this paper, ReByte, a runtime monitoring method for security enhancement of smart contracts deployed on Ethereum, is proposed. This method is based on a function-call interceptor for smart contracts that operates at runtime, and it checks the security-related properties of smart contracts and takes the corresponding measures described in a JSON policy file. At the beginning of its runtime, a smart contract bytecode is dynamically rewritten to embed within it the policy enforcement logic. The results of experiments on real-world Ethereum smart contracts on EtherScan [18] show that the ReByte prototype efficiently enhances the safety of smart contracts.