As Long As I See It - OSVHunter: Understanding and Detecting Open-Secret Vulnerabilities in Smart Contracts

Abstract

This paper centers on open-secret vulnerabilities (OSVs), a kind of smart contract vulnerability that allows attackers to exploit the natural transparency feature of blockchains to gain illegal monetary profits from problematic smart contracts. Attackers can easily launch OSV attacks by leveraging publicly visible information from a smart contract to issue a profitable transaction without violating its business logic. This poses significant challenges in detecting OSVs. Despite the severe impacts of OSVs, there is no prior research work that systematically discusses OSVs (to the best of our knowledge). To fill this knowledge gap, this paper presents a formal definition of OSVs, and OSVHunter, the first-ever tool aiming to detect OSVs in smart contracts. The detection results show that OSVs are prevalent in real-world smart contracts. Some of these vulnerabilities are even concealed within highly popular Ethereum contracts, with individual contract valuations exceeding five hundred thousand U.S. dollars. These vulnerabilities appear in finance, gaming, gambling, etc. We hope this paper can arouse our community’s attention to the significance of OSVs and lay the technical foundation for future research.