Finding The Greedy, Prodigal, and Suicidal Contracts at Scale

By Ivica Nikolic, Aashish Kolluri, Ilya Sergey, Prateek Saxena, Aquinas Hobor. Asia-Pacific Computer Systems Architecture Conference, 2018

673 citations recorded by the source corpus.

Smart contracts---stateful executable objects hosted on blockchains like Ethereum---carry billions of dollars worth of coins and cannot be updated once deployed. We present a new systematic characterization of a class of trace vulnerabilities, which result from analyzing multiple invocations of a contract over its lifetime. We focus attention on three example properties of such trace vulnerabilities: finding contracts that either lock funds indefinitely, leak them carelessly to arbitrary users, or can be killed by anyone. We implemented Maian, the first tool for specifying and reasoning about trace properties, which employs interprocedural symbolic analysis and concrete validator for exhibiting real exploits. Our analysis of nearly one million contracts flags 34, 200 (2, 365 distinct) contracts vulnerable, in 10 seconds per contract. On a subset of 3, 759 contracts which we sampled for concrete validation and manual analysis, we reproduce real exploits at a true positive rate of 89%, yielding exploits for 3, 686 contracts. Our tool finds exploits for the infamous Parity bug that indirectly locked $200 million US worth in Ether, which previous analyses failed to capture.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/25d9e16a16582ce46607e6b646015a82d1188a74

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

ContractFuzzer: Fuzzing Smart Contracts for Vulnerability Detection (2018, methodology): “Nikolic et al [12] designed MAIAN, a symbolic execution tool for reasoning about tracing properties to detect vulnerable smart contracts.”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, methodology): “However, they cannot deal with multiple transactions. teEther [37] (only detects Leaking) and Maian [42] can generate exploits over multiple transactions.”
Smart Contract Vulnerability Detection using Graph Neural Network (2020, methodology): “Current work mainly relies on symbolic execution methods, such as Oyente [Luu et al. , 2016], Ma-ian [Nikoli´c et al. , 2018] and Securify [Tsankov et al. , 2018], which suffer from high false negative rates due to the inability to explore all possible program paths.”
Sereum: Protecting Existing Smart Contracts Against Re-Entrancy Attacks (2018, background): “Other recent approaches use symbolic execution to automatically construct exploits in order to demonstrate the vulnerability of an analyzed smart contract [27], [32].”
Securify: Practical Security Analysis of Smart Contracts (2018, background): “Examples include Oyente [42], Mythril [17], and Maian [47].”
Combining Graph Neural Networks With Expert Knowledge for Smart Contract Vulnerability Detection (2021, background): “symbolic execution, such as Oyente [8], Maian [26], and Securify [18].”
Osiris: Hunting for Integer Bugs in Ethereum Smart Contracts (2018, methodology): “Hence, we only scratched the tip of the iceberg, by analysing only 495 of them.”
Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts (2019, methodology): “In a preliminary study performed on nearly one million Ethereum smart contracts, using one analysis framework for verifying correctness, 34,200 of them were flagged as vulnerable [32].”
Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts (2019, methodology): “Symbolic execution in the Ethereum space is much less widely explored, but a few other tools do exist, such as Mythril Classic [2], teEther [10], Oyente [11] and Maian [12].”
Vandal: A Scalable Security Analysis Framework for Smart Contracts (2018, background): “Unsecured balance vulnerabilities occur when a contract’s balance is exposed to theft by an arbitrary caller [21].”
Slither: A Static Analysis Framework for Smart Contracts (2019, background): “contracts, locked ether, or arbitrary sending of ether [15].”
A Survey on Ethereum Systems Security (2019, background): “Maian [55] (10) extends Oyente by considering multiple invocations of a contract, rather than a single invocation.”
sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts (2020, methodology): “In [25], Nikolic et al. presented a tool named MAIAN, which can find 3 types of trace vulnerabilities.”
An Overview on Smart Contracts: Challenges, Advances and Platforms (2019, neutral): “2) Dynamic control flow • Path-searching [63]”