An exploratory study on solidity guards and ether exchange constructs

Abstract

Ethereum is a blockchain platform that enables the use of smart contracts. Smart contracts will execute a set of instructions without an intermediary party when called upon. The possibility to make calls to another contract or exchange cryptocurrency allows for potential exploits to occur, most notable reentrancy. The Solidity language for coding smart contracts has syntactic constructs created to be safer alternatives, and guards to aid in securing code against exploits. In this paper, we collect a total of 26,799 verified Solidity smart contracts from Etherscan, to analyze the language constructs used in calling another contract or exchanging ether. We also analyze the usage of guards to make the code more secure. For instance, even though call is the unsafest function, it is still used by 50% of the contracts in our dataset. The safe method transfer is used by approximately one-third of contracts, and send is rarely used. We noticed that contracts using call have a higher average and median size in Lines of Code than normal. We also found an increased percentage of call contracts using more guards. Moreover, 97% of all contracts are using the require guard, with 23 uses of require on average per contract. This may be an indication that Solidity developers are using more guards to prevent exploits in their contracts