PERCI - Smart Contract Verification Process for IoT applications

Abstract

The growth of devices in the Internet of Things (IoT) has brought an increase in the amount of data flowing through the network. As a consequence of that, a reliable environment has became essential to avoid security vulnerabilities. In this scenario, Blockchain emerges as a promising technology to enhance IoT security, enabling decentralized, encrypted, and immutable data registration with the consensus of network participants. Smart contracts are self-executing programs distributed in a Blockchain. In IoT applications that use Blockchain, smart contracts can eliminate the need for intermediaries, allowing for more secure and transparent data transfers between involved parties in a decentralized manner. However, smart contracts are subject to security flaws, mainly caused by programming errors and vulnerabilities in the source code, which can result in financial losses or compromise data integrity, posing risks to users’ privacy and security. Therefore, performing tests with different approaches before deployment can expose errors in the smart contract code and reduce security risks. This work then proposes a process, called PERCI, that defines a set of verification steps for smart contracts in IoT applications to detect known vulnerabilities, using a combination of static and dynamic analysis tools before the contract deployment. The combination of static and dynamic analyses is proposed to improve vulnerability detection, providing a more robust solution. For this, the process uses two static analysis tools, Slither and Mythril, and one dynamic analysis tool, Manticore. PERCI is evaluated, firstly, by demosntrating that the combination of the analyses of each tool resulted in more efficient vulnerability detection, providing a more comprehensive and precise verification of the smart contract code. Additionally, this work integrated a smart contract to register and authenticate devices on the Blockchain with an IoT application that shows weather conditions through colors with a smart lamp. The process evaluation demonstrated the feasibility of using combined static and dynamic analyses for more efficient vulnerability detection. Finally, this dissertation is expected to contribute to improving the security and the reliability of IoT applications that use Blockchain.