Sereum: Protecting Existing Smart Contracts Against Re-Entrancy Attacks

By Michael Rodler, Wenting Li, Ghassan O. Karame, Lucas Davi. Network and Distributed System Security Symposium, 2018

313 citations recorded by the source corpus.

Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Although the literature features a number of proposals for securing smart contracts, these proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. In this paper, we address this problem in the context of re-entrancy exploits and propose a novel smart contract security technology, dubbed Sereum (Secure Ethereum), which protects existing, deployed contracts against re-entrancy attacks in a backwards compatible way based on run-time monitoring and validation. Sereum does neither require any modification nor any semantic knowledge of existing contracts. By means of implementation and evaluation using the Ethereum blockchain, we show that Sereum covers the actual execution flow of a smart contract to accurately detect and prevent attacks with a false positive rate as small as 0.06% and with negligible run-time overhead. As a by-product, we develop three advanced re-entrancy attacks to demonstrate the limitations of existing offline vulnerability analysis tools.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/729e2ee148f8413eeeb60f0ece4b1a1a9725e538

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Combining Graph Neural Networks With Expert Knowledge for Smart Contract Vulnerability Detection (2021, methodology): “Sereum [29] uses taint analysis to monitor runtime data flows during smart contract execution for vulnerability detection.”
SoK: Decentralized Finance (DeFi) (2021, background): “A contract is potentially vulnerable to a reentrancy attack if it delegates control to an untrusted contract, by calling it with a large enough gas limit, while its state is partially modified [109].”
A Survey on Ethereum Systems Security (2019, background): “Sereum [162] (D50) uses taint analysis to monitor runtime data flows during smart contract execution for detecting and preventing the reentrancy vulnerability (V1).”