The increasing use of information and communication technology over the last decade has driven a new range of information needs in business. A number of these software systems in deployment, however, suffer from detrimental unintended integrity and consistency compromise due to anomaly infestation. Primarily, the effects of this usually culminate in unpredictable and catastrophic results, which must be adequately checked to yield highly dependable software. This paper proposes a unified framework for analyzing propagations of anomalies in software systems employing ontology to characterize, categorize, and identify these errors; also, to provide guidelines for the implementation of the proposed solution. The generic approach captures the conventional semantics and structure of different types of anomalies with the notion of anomaly ontology. The prototype Ontology-based Software Anomaly Propagation Detection System (OBSAPDS) was built with the Protégé 4.3 knowledge acquisition tool, and Java programming languagPe was used for the development of the application and MySQL Server as the back en--gine. The combination of the domain ontology in Protégé and inference rules in Jena formed the knowledge system for the elicitation and the validation of domain facts. Besides, a proof-of-concept evaluation of the proposed framework confirmed how efficiently the approach could discover and resolve anomalies for different types of systems through demonstration. The division by zero error and the read access to uninitialized error conditions served as case studies.Keywords: Ontology, software systems, anomaly propagation
Smart Contracts are computer programs which implement and execute transactions and manage business logic on a decentralized public ledger. Smart Contracts can be written in different programming languages and for different Blockchains. Currently the most used language for Smart Contracts is Solidity and the most used platform is the Ethereum Blockchain. Assessing the quality of Smart Contract programs is an important task required to professional programmers, especially when a programming language has so powerful economic implications. It is therefore crucial to provide professional programmers with tools for the evaluation of Smart Contracts. In software engineering, software metrics has been defined and used to measure software quality and, more in general, to qualify software under the principle “You Can't Manage What You Don't Measure”. For the Solidity programming language there are only a few Standalone Applications to analyse the Smart Contract metrics. The aim of this paper is first to build a tool for the practical computation of a specific set of Solidity source code metrics, so that the set will be extensible in the future according also to Solidity compiler evolution, second to fully enable a web-based usage of the tool to access the metrics of the Solidity programming language. The tool, PASO, differently from the existing application, is able to give software metrics values for Smart Contracts written in Solidity programming language just using a web browser.
Zhipeng Gao, Lingxiao Jiang, Xin Xia, David Lo · 5 authors
Smart contracts have been increasingly used together with blockchains to automate financial and business transactions. However, many bugs and vulnerabilities have been identified in many contracts which raises serious concerns about smart contract security, not to mention that the blockchain systems on which the smart contracts are built can be buggy. Thus, there is a significant need to better maintain smart contract code and ensure its high reliability. In this paper, we propose an automated approach to learn characteristics of smart contracts in Solidity, which is useful for clone detection, bug detection and contract validation on smart contracts. Our new approach is based on word embeddings and vector space comparison. We parse smart contract code into word streams with code structural information, convert code elements (e.g., statements, functions) into numerical vectors that are supposed to encode the code syntax and semantics, and compare the similarities among the vectors encoding code and known bugs, to identify potential issues. We have implemented the approach in a prototype, named SmartEmbed,11.The anonymous replication packages can be accessed at:https://drive.google.com/file/d/1kauLT3y2IiHPkUlVx4FSTda-dVAyL4za/view?usp=sharing.and evaluated it with more than 22,000 smart contracts collected from the Ethereum blockchain. Results show that our tool can effectively identify many repetitive instances of Solidity code, where the clone ratio is around 90 percent. Code clones such as type-III or even type-IV semantic clones can also be detected accurately. Our tool can identify more than 1000 clone related bugs based on our bug databases efficiently and accurately. Our tool can also help to efficiently validate any given smart contract against a known set of bugs, which can help to improve the users’ confidence in the reliability of the contract.
The challenge of automatically determining the correctness of test executions is referred to as the test oracle problem and is one of the key remaining issues for automated testing. The goal in this paper is to solve the test oracle problem in a way that is general, scalable and accurate. To achieve this, we use supervised learning over test execution traces. We label a small fraction of the execution traces with their verdict of pass or fail. We use the labelled traces to train a neural network (NN) model to learn to distinguish runtime patterns for passing versus failing executions for a given program. Our approach for building this NN model involves the following steps, 1. Instrument the program to record execution traces as sequences of method invocations and global state, 2. Label a small fraction of the execution traces with their verdicts, 3. Designing a NN component that embeds information in execution traces to fixed length vectors, 4. Design a NN model that uses the trace information for classification, 5. Evaluate the inferred classification model on unseen execution traces from the program. We evaluate our approach using case studies from different application domains: 1. Module from Ethereum Blockchain, 2. Module from PyTorch deep learning framework, 3. Microsoft SEAL encryption library components, 4. Sed stream editor, 5. Value pointer library and 6. Nine network protocols from Linux packet identifier, L7-Filter. We found the classification models for all subject programs resulted in high precision, recall and specificity, over 95%, while only training with an average 9% of the total traces. Our experiments show that the proposed neural network model is highly effective as a test oracle and is able to learn runtime patterns to distinguish passing and failing test executions for systems and tests from different application domains.
Cryptocurrency development has continuous escalation in the past years and holds its presence significantly in open source development. Online collaborative software development platforms such as GitHub offer us an opportunity to observe developer effort, activity and software growth. Cryptocurrency has enabled various applications such as smart contracts, electronically decentralized payments, etc. Since, prices of each cryptocurrency are driven by many factors, we are interested in investigating how various characteristics of cryptocurrency's codebase development affect market capitalization price. Thus, we conduct a study on a panel dataset containing nearly a year of daily observations of development activity, popularity, and market capitalization for over two hundred open source cryptocurrencies.
Naoki Kobayakawa, Mitsuyoshi Imamura, Kei Nakagawa, Kenichi Yoshida
Open source software (OSS) has become indispensable to our society. The success of OSS depends on the participation of a large number of developers or maintainers (contributors). Shedding light on the mechanisms of their participation has been an important academic and practical matter. One aspect to decide participation is the future prospects of a project. However, the causal mechanism behind participation has yet to be studied exhaustively and remains unclear. In this study, we used cryptocurrency projects, many of them were developed on GitHub, to better understand this mechanism. Both GitHub and cryptocurrencies are highly transparent, i.e., information is fully disclosed; we can analyze relevant information on a project, such as the contributors' activities, financial information, and development status. We adopted market capitalization as the substitution index of future prospects and the number of contributors and analyzed the relationship using time series analysis techniques, such as the Granger causality test and regression. We found that the number of contributors increases two months after market capitalization increases. This quantifies the impact of the future prospects of the project, i.e., of the market capitalization of a cryptocurrency, on the participation of contributors.
Chunmiao Li, Shijie Nie, Yang Cao, Yijun Yu · 5 authors
Smart contracts on Ethereum can be used to encode business logic and have been applied to many different areas, such as token exchanges and games. Unlike general programs, the computations of contracts on Ethereum are restricted by the gas limit. If a transaction runs out of the gas limit before an execution finishes, the Ethereum virtual machine throws an out-of-gas exception, and the entire transaction fails, which reverts to the state before the transaction started, although the transaction fee is still deducted. It is therefore, essential to conduct a gas estimation before sending a transaction. Existing studies have mostly failed in estimating the gas for a loop function because the number of iterations of the loops cannot be statically determined. However, we found that a quarter of all contracts have loop functions, and the gas cost for the loops is higher than for the other functions. Therefore, it is necessary to apply a gas estimation for the loop functions. In this study, we propose a gas estimation approach based on the transaction trace to dynamically estimate the gas for the loop functions. Our belief is that we can learn the relationship between the historical transaction traces and their gas costs to estimate the gas for new transactions. We considered three different abstractions of the original transaction trace and fed them to different machine learning models. The results show that our approach is effective in gas estimation and that a random forest can achieve the most accurate estimation.
We address the absence of reliable tests on contract analyzers of smart contracts and present a systematic method to diversify test cases by combining smart-contract-specific bugs and static analysis barriers in this paper. Using contract analyzers is the most practical solution for building a secure blockchain service, but they are relatively immature and lacking stable performance metrics. Traditionally, performance reports only compare static contract analyzers with pre-defined test cases, such as the Juliet test suite. However, building such test suites is burdensome for smart contracts, which are frequently change. In this paper, we propose an automated method to assess contract analyzers of smart contracts by diversifying test cases. In the experimental results, we identified nine erroneous alarms in the state-of-the-art contract analyzers with automatically generated test cases on five vulnerabilities.
Programming language design requires making many usability-related design decisions. However, existing HCI methods can be impractical to apply to programming languages: they have high iteration costs, programmers require significant learning time, and user performance has high variance. To address these problems, we adapted both formative and summative HCI methods to make them more suitable for programming language design. We integrated these methods into a new process, PLIERS, for designing programming languages in a user-centered way. We evaluated PLIERS by using it to design two new programming languages. Glacier extends Java to enable programmers to express immutability properties effectively and easily. Obsidian is a language for blockchains that includes verification of critical safety properties. Summative usability studies showed that programmers were able to program effectively in both languages after short training periods.
Aug 9, 2019·Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
Used as a platform for executing smart contracts, Blockchain technology has yielded new programming languages. We propose a graph-based framework for computing software design metrics for the Solidity programming language, and use this framework in a preliminary study on 505 smart contracts mined from GitHub. The results show that most of the smart contracts are rather straightforward from an objected-oriented point of view and that new design metrics specific to smart contracts should be developed.
Yury Zhauniarovich, Yazan Boshmaf, Husam Al Jawaheri, Mashael Al Sabah
Web-based hosting services for version control, such as GitHub, have made it easier for people to develop, share, and donate money to software repositories. In this paper, we study the use of Bitcoin to make donations to open source repositories on GitHub. In particular, we analyze the amount and volume of donations over time, in addition to its relationship to the age and popularity of a repository. We scanned over three million repositories looking for donation addresses. We then extracted and analyzed their transactions from Bitcoin's public blockchain. Overall, we found a limited adoption of Bitcoin as a payment method for receiving donations, with nearly 44 thousand deposits adding up to only 8.3 million dollars in the last 10 years. We also found weak positive correlation between the amount of donations in dollars and the popularity of a repository, with highest correlation (r=0.013) associated with number of forks.
Blockchain-related discussions have become increasingly prevalent in programming Q&A websites, such as Stack Overflow and other Stack Exchange communities. Analyzing and understanding those discussions could provide insights about the topics of interest to practitioners, and help the software development and research communities better understand the needs and challenges facing developers as they work in this new domain. Prior studies propose the use of LDA to study the Stack Exchange discussions. However, a simplistic use of LDA would capture the topics in discussions blindly without keeping in mind the variety of the dataset and domain-specific concepts. Specifically, LDA is biased towards larger sized corpora; and LDA-derived topics are not linked to higher level domain-specific concepts. We propose an approach that combines balanced LDA (which ensures that the topics are balanced across a domain) with the reference architecture of a domain to capture and compare the popularity and impact of discussion topics across the Stack Exchange communities. Popularity measures the distribution of interest in discussions, and impact gauges the trend of popularity over time. We made a number of interesting observations, including: (1) Bitcoin, Ethereum, Hyperledger Fabric and Corda are the four most commonly-discussed blockchain platforms on the Stack Exchange communities. (2) A broad range of topics are discussed across the various platforms of distinct layers in our derived reference architecture. (3) The Application layer topics exhibit the highest popularity (33.2 percent) and fastest growth in topic impact since November 2015. (4) The Application, API, Consensus and Network layer topics are discussed across the studied blockchain platforms, but exhibit different distributions in popularity. (5) The impact of architectural layer topics exhibits an upward trend, but is growing at different speeds across the studied blockchain platforms. The breakdown of the topic impact across the architectural layers is relatively stable over time except for the Hyperledger Fabric platform. Based on our findings, we highlighted future directions and provided recommendations for practitioners and researchers.
Automatic test generation typically aims to generate inputs that explore new paths in the program under test in order to find bugs. Existing work has, therefore, focused on guiding the exploration toward program parts that are more likely to contain bugs by using an offline static analysis. In this paper, we introduce a novel technique for targeted greybox fuzzing using an online static analysis that guides the fuzzer toward a set of target locations, for instance, located in recently modified parts of the program. This is achieved by first semantically analyzing each program path that is explored by an input in the fuzzer's test suite. The results of this analysis are then used to control the fuzzer's specialized power schedule, which determines how often to fuzz inputs from the test suite. We implemented our technique by extending a state-of-the-art, industrial fuzzer for Ethereum smart contracts and evaluate its effectiveness on 27 real-world benchmarks. Using an online analysis is particularly suitable for the domain of smart contracts since it does not require any code instrumentation---instrumentation to contracts changes their semantics. Our experiments show that targeted fuzzing significantly outperforms standard greybox fuzzing for reaching 83% of the challenging target locations (up to 14x of median speed-up).
Jiachi Chen, Xin Xia, David Lo, John Grundy · 6 authors
Smart contracts are programs running on a blockchain. They are immutable to
patch for bugs once deployed -- it is critical to ensure they are bug-free and
well-designed before deploying. Code smells are symptoms in source code that
possibly indicate deeper problems. The detection of code smells is a method to
avoid potential bugs and improve the design of existing code. However,
traditional code smell patterns are designed for centralized OO programs, e.g.,
Java or C++; while smart contracts are decentralized and contain numerous
distinctive features, such as the gas system. To fill this gap, we collected
smart-contract-related posts from Stack Exchange, as well as real-world smart
contracts. We manually analyzed these posts and defined 20 kinds of \emph{code
smells for smart contracts. We categorized these into security, architecture,
and usability problems. To validate if practitioners consider these contract
smells as harmful, we created an online survey and received 96 responses from
24 different countries. Feedback showed these code smells are harmful and
removing them would improve quality and robustness of smart contracts. We
manually identified our defined code smells in 587 contract accounts and
publicly released our dataset. Finally, we summarized 5 impacts caused by
contract code smells. These help developers better understand the symptoms of
the smells and removal priority.
In Korea, a budget of tens of trillion won is put into the national R & D project every year [1]. Thanks to continuous technology and industrial development, Korea's ICT industry is gaining global attention. National R & D projects manage R & D projects in order of Planning - Evaluation - Management - Project results. In Korea, the R & D cycle process is diverse from the planning stage to the research results manager stage. In other words, we manage planning and evaluation by different departments and institutions. This type of management leads to problems such as redundant planning, insufficient sharing of research results, and duplicate submission. Currently, NTIS (National Technology Information Service) provides to address issues of redundancy and sharing. However, the NTIS's review of project redundancy is centered on keywords and does not provide information on the planning stage. This situation leads to redundant planning by ministries and closed management of research results. Therefore, we propose a platform that can easily share project planning information, review project redundancy, share research results, and check duplication of research results using block chain technology, which many experts and entrepreneurs refer to as future innovative technologies. In this paper, we propose a platform called Perfect Sharing Project Platform (PSPP). We describe that PSPP can achieve excellent research results through information sharing of project process. To support the perfect sharing, this platform uses a new notion of consensus algorithm, called POA (Proof of Atomicity). This platform is suitable for sharing information.
Wesley Dingman, Aviel Cohen, Nick Ferrara, Adam Lynch · 7 authors
Blockchain technology has recently emerged as the primary platform for the transfer of digital currency. This technology, which has been heralded as a revolutionary tool to facilitate the transfer of funds between participating parties, is still in its infancy and should be subjected to thorough scrutiny. In recent years, researchers have attempted to uncover a litany of bugs embedded within these distributed systems; however, there does not yet exist a formal and standardized method for their classification. In this paper, we present the first formal classifications of known bugs in smart contract systems using NIST's Bugs Framework and propose two new classes: Distributed System Protocol (DSP) and Distributed System Resource Management (DRM).
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Elizabeth Reilly, Matthew Maloney, Michael Siegel, Gregory Falco
Smart cities and advanced energy delivery systems are examples of IoT rich environments. These systems are responsible for communicating critical data about urban infrastructure that keeps our modern cities functioning. Today, IoT devices lack communication protocols with data integrity as a priority. Without data integrity, these systems are at risk of actuating urban environments on compromised data. Attackers can use this IoT communication flaw to wage cyber-physical attacks. We designed and developed an integrity-first communication protocol for IoT that is distributed and scalable based on the Ethereum blockchain. Our light client ensures data communication integrity for systems that require it most.
Ningyu He, Lei Wu, Haoyu Wang, Yao Guo · 5 authors
In this paper, we present the first large-scale and systematic study to characterize the code reuse practice in the Ethereum smart contract ecosystem. We first performed a detailed similarity comparison study on a dataset of 10 million contracts we had harvested, and then we further conducted a qualitative analysis to characterize the diversity of the ecosystem, understand the correlation between code reuse and vulnerabilities, and detect the plagiarist DApps. Our analysis revealed that over 96% of the contracts had duplicates, while a large number of them were similar, which suggests that the ecosystem is highly homogeneous. Our results also suggested that roughly 9.7% of the similar contract pairs have exactly the same vulnerabilities, which we assume were introduced by code clones. In addition, we identified 41 DApps clusters, involving 73 plagiarized DApps which had caused huge financial loss to the original creators, accounting for 1/3 of the original market volume.
Driven by the surge of interest generated around blockchain technologies over the last years, a new category of systems, called Blockchain-Oriented Software (BOS), which are strictly tied to Blockchain distributed environment, has become increasingly popular. Yet, there is not a thorough understanding of their structure and behaviour and if and to which extent they differ from traditional software systems. The present work provide a first statistical characterisation of BOS. We analysed and compared 5 C++ open source Blockchain-Oriented and 5 Traditional Java software systems, aiming at detecting potential differences between the two categories of projects, and specifically in the statistical distribution of 10 software metrics. Although, in general, the statistical distributions for Traditional software and Blockchain software show similarities, the distribution of Average Cyclomatic and Ration Comment To Code metrics reveal significant differences in their queue, whereas the Number of Statements metric shows meaningful differences on the double Pareto distribution.
The blockchain technology has potential applications in various areas such as smart-contracts, Internet of Things (IoT), land registry, supply chain management, storing medical data, and identity management. Although the Github currently hosts more than six thousand active Blockchain software (BCS) projects, few software engineering research has investigated these projects and its' contributors. Although the number of BCS projects is growing rapidly, the motivations, challenges, and needs of BCS developers remain a puzzle. Therefore, the primary objective of this study is to understand the motivations, challenges, and needs of BCS developers and analyze the differences between BCS and non-BCS development. On this goal, we sent an online survey to 1,604 active BCS developers identified via mining the Github repositories of 145 popular BCS projects. The survey received 156 responses that met our criteria for analysis. The results suggest that the majority of the BCS developers are experienced in non-BCS development and are primarily motivated by the ideology of creating a decentralized financial system. Although most of the BCS projects are Open Source Software (OSS) projects by nature, more than 93% of our respondents found BCS development somewhat different from a non-BCS development as BCS projects have higher emphasis on security and reliability than most of the non-BCS projects. Other differences include: higher costs of defects, decentralized and hostile environment, technological complexity, and difficulty in upgrading the software after release. Software development tools that are tuned for non-BCS development are inadequate for BCS and the ecosystem needs an array of new or improved tools, such as: customized IDE for BCS development tasks, debuggers for smart-contracts, testing support, easily deployable simulators, and BCS domain specific design notations.
Oct 26, 2018·Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
The Ethereum ecosystem has created a prosperity of smart contract applications in public blockchains, with transparent, traceable and programmable transactions. However, the flexibility that everybody can write and deploy smart contracts on Ethereum causes a large collection of similar contracts, i.e., clones. In practice, smart contract clones may amplify severe threats like security attacks, resource waste etc.
Background: The application of the blockchain technology has shown promises in various areas, such as smart-contracts, Internet of Things, land registry management, identity management, etc. Although Github currently hosts more than three thousand active blockchain software (BCS) projects, a few software engineering research has been conducted on their software engineering practices. Aims: To bridge this gap, we aim to carry out the first formal survey to explore the software engineering practices including requirement analysis, task assignment, testing, and verification of blockchain software projects. Method: We sent an online survey to 1,604 active BCS developers identified via mining the Github repositories of 145 popular BCS projects. The survey received 156 responses that met our criteria for analysis. Results: We found that code review and unit testing are the two most effective software development practices among BCS developers. The results suggest that the requirements of BCS projects are mostly identified and selected by community discussion and project owners which is different from requirement collection of general OSS projects. The results also reveal that the development tasks in BCS projects are primarily assigned on voluntary basis, which is the usual task assignment practice for OSS projects. Conclusions: Our findings indicate that standard software engineering methods including testing and security best practices need to be adapted with more seriousness to address unique characteristics of blockchain and mitigate potential threats.
As the complexity of software increases, the importance of software quality is ever increasing, as everyone recognizes. In order to secure software quality, various engineering methods have been proposed. However, because these methods are very specialized, the reality is that it is difficult to apply them to a distributed and small-scale development environment. So, to solve this problem, a tool to analyze the quality of source code is used. Still, it is not easy to rely on code quality in a distributed development environment. In this study, source code quality data measured in a distributed development environment is stored in a blockchain ledger based on a graph database. In this way, the reliability of code quality in a distributed development environment can be enhanced.