Vandal: A Scalable Security Analysis Framework for Smart Contracts

By Lexi Brent, Anton Jurisevic, Michael Kong, Eric Liu, François Gauthier, Vincent Gramoli, Ralph Holz, Bernhard Scholz. arXiv.org, 2018

318 citations recorded by the source corpus.

The rise of modern blockchains has facilitated the emergence of smart contracts: autonomous programs that live and run on the blockchain. Smart contracts have seen a rapid climb to prominence, with applications predicted in law, business, commerce, and governance. Smart contracts are commonly written in a high-level language such as Ethereum's Solidity, and translated to compact low-level bytecode for deployment on the blockchain. Once deployed, the bytecode is autonomously executed, usually by a %Turing-complete virtual machine. As with all programs, smart contracts can be highly vulnerable to malicious attacks due to deficient programming methodologies, languages, and toolchains, including buggy compilers. At the same time, smart contracts are also high-value targets, often commanding large amounts of cryptocurrency. Hence, developers and auditors need security frameworks capable of analysing low-level bytecode to detect potential security vulnerabilities. In this paper, we present Vandal: a security analysis framework for Ethereum smart contracts. Vandal consists of an analysis pipeline that converts low-level Ethereum Virtual Machine (EVM) bytecode to semantic logic relations. Users of the framework can express security analyses in a declarative fashion: a security analysis is expressed in a logic specification written in the \souffle language. We conduct a large-scale empirical study for a set of common smart contract security vulnerabilities, and show the effectiveness and efficiency of Vandal. Vandal is both fast and robust, successfully analysing over 95\% of all 141k unique contracts with an average runtime of 4.15 seconds; outperforming the current state of the art tools---Oyente, EthIR, Mythril, and Rattle---under equivalent conditions.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/85e0063f0c988703fdb0163b6665c4b3e45cdb3e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

The Roadmap to 6G Security and Privacy (2021, unknown): “The accurate functionality of smart contacts can be checked by identifying semantic flaws [101], [102], using security check tools [103], [104], [105] and performing formal verification [106]–[109].”
A Survey on Ethereum Systems Security (2019, unknown): “Vandal [75] (D19) translates EVM bytecode into logic relations and use them to detect a number of vulnerabilities, such as the reentrancy vulnerability (V1), the authentication through tx.”
An Overview on Smart Contracts: Challenges, Advances and Platforms (2019, unknown): “…[40] 2) Functional issues • Block randness [41], [42], [43] • Overcharging [44], [45] Deployment • Bytecode analysis [46], [47], [48], [49], [50], [51], [52], [53] 1) Contract correctness • Source code analysis [54], [55], [56], [57] • Machine learning based analysis [58], [59], [60] • Graph…”
Survey on blockchain based smart contracts: Applications, opportunities and challenges (2021, methodology): “[246] provided a security analysis framework for Ethereum smart contracts.”
Slither: A Static Analysis Framework for Smart Contracts (2019, methodology): “It aims to provide both security and style guide validations. It is open-source and it is implemented in NodeJS using the SolidityJ parser [2]. Other notable static analysis frameworks include Vandal [4] and EtherTrust [10]. GASPER [5] and GasReduce [6] use static analysis to detect potential optimi”
Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts (2019, unknown): “33 Vandal [4] https://github.”
MadMax: surviving out-of-gas conditions in Ethereum smart contracts (2018, methodology): “Our decompiler, code named Vandal [Brent et al. 2018; Various 2018], has been released as a freely-available, self-standing tool.”
Smart Contract Development: Challenges and Opportunities (2021, methodology): “proposed a framework called Vandal that decompiled EVM bytecode and allowed developers to analyze bytecode via logic specification [16].”