MadMax: surviving out-of-gas conditions in Ethereum smart contracts

By Neville Grech, Michael Kong, Anton Jurisevic, Lexi Brent, Bernhard Scholz, Yannis Smaragdakis. Proc. ACM Program. Lang., 2018

385 citations recorded by the source corpus.

Ethereum is a distributed blockchain platform, serving as an ecosystem for smart contracts: full-fledged inter-communicating programs that capture the transaction logic of an account. Unlike programs in mainstream languages, a gas limit restricts the execution of an Ethereum smart contract: execution proceeds as long as gas is available. Thus, gas is a valuable resource that can be manipulated by an attacker to provoke unwanted behavior in a victim's smart contract (e.g., wasting or blocking funds of said victim). Gas-focused vulnerabilities exploit undesired behavior when a contract (directly or through other interacting contracts) runs out of gas. Such vulnerabilities are among the hardest for programmers to protect against, as out-of-gas behavior may be uncommon in non-attack scenarios and reasoning about it is far from trivial. In this paper, we classify and identify gas-focused vulnerabilities, and present MadMax: a static program analysis technique to automatically detect gas-focused vulnerabilities with very high confidence. Our approach combines a control-flow-analysis-based decompiler and declarative program-structure queries. The combined analysis captures high-level domain-specific concepts (such as "dynamic data structure storage" and "safely resumable loops") and achieves high precision and scalability. MadMax analyzes the entirety of smart contracts in the Ethereum blockchain in just 10 hours (with decompilation timeouts in 8% of the cases) and flags contracts with a (highly volatile) monetary value of over $2.8B as vulnerable. Manual inspection of a sample of flagged contracts shows that 81% of the sampled warnings do indeed lead to vulnerabilities, which we report on in our experiment.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/657890a22a7e1a0fe6a509e0b178be3fa6ca0370

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts (2019, neutral): “semantics 13 MadMax [17] https://github.”
Vandal: A Scalable Security Analysis Framework for Smart Contracts (2018, result): “actual analysis in the SeaHorn veri- cation framework [52]. An alternative approach is that of [50], in which Solidity code is abstracted to nite-state automata. The approach of our Vandal framework [54] is also partly that of abstract interpretation. However, in contrast to the aforementioned abstr”
A Survey on Ethereum Systems Security (2019, background): “MadMax [62] (18) disassembles EVM bytecode into an intermediate representation and then leverages both dataflow analysis and context-sensitive flow analysis to detect gas-related vulnerabilities, such as the DoS with unbounded operations vulnerability (14).”
Understanding Ethereum via Graph Analysis (2020, background): “There are various studies about Ethereum’s security [16, 24, 32, 33, 43] and performance [15, 17].”
An Overview on Smart Contracts: Challenges, Advances and Platforms (2019, neutral): “…[38], [39], [40] 2) Functional issues • Block randness [41], [42], [43] • Overcharging [44], [45] Deployment • Bytecode analysis [46], [47], [48], [49], [50], [51], [52], [53] 1) Contract correctness • Source code analysis [54], [55], [56], [57] • Machine learning based analysis [58], [59], [60]…”
Smart Contract Development: Challenges and Opportunities (2021, background): “Besides formal verification, some researchers proposed to abstract smart contacts to a certain form before conducting relevant verification tasks [71], [50].”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, methodology): “Static analysis systems based on Datalog [24, 62] or the LLVM analysis engine [33] provide soundness guarantee but can have false positives and do not generate exploits.”
Survey on blockchain based smart contracts: Applications, opportunities and challenges (2021, background): “[277] classified and identified the gas focused on vulnerabilities found in the Ethereum smart contracts.”