Osiris: Hunting for Integer Bugs in Ethereum Smart Contracts
By Christof Ferreira Torres, Julian Schütte, Radu State. Asia-Pacific Computer Systems Architecture Conference, 2018
479 citations recorded by the source corpus.
The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed once deployed to the blockchain. They typically implement the business logic of distributed apps and carry billions of dollars worth of coins. In that respect, it is imperative that smart contracts are correct and have no vulnerabilities or bugs. However, research has identified different classes of vulnerabilities in smart contracts, some of which led to prominent multi-million dollar fraud cases. In this paper we focus on vulnerabilities related to integer bugs, a class of bugs that is particularly difficult to avoid due to some characteristics of the Ethereum Virtual Machine and the Solidity programming language. In this paper we introduce Osiris -- a framework that combines symbolic execution and taint analysis, in order to accurately find integer bugs in Ethereum smart contracts. Osiris detects a greater range of bugs than existing tools, while providing a better specificity of its detection. We have evaluated its performance on a large experimental dataset containing more than 1.2 million smart contracts. We found that 42,108 contracts contain integer bugs. Besides being able to identify several vulnerabilities that have been reported in the past few months, we were also able to identify a yet unknown critical vulnerability in a couple of smart contracts that are currently deployed on the Ethereum blockchain.
Subfields: Artificial Intelligence, Information Systems, Signal Processing
View Paper: https://www.semanticscholar.org/paper/c514197b3a71be8c0fe3481a6cc3d0e581a40e43
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
In Information Systems
- Tharaka Mawanane Hewa
- Rui Abreu
- Madhusanka Liyanage
- Quang Tran Minh
- Mika E. Ylianttila
- Tai D. Nguyen
- Long H. Pham
- Jun Sun
In Signal Processing
Citations in the corpus
- Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, unknown): “Osiris [61] detects integer bugs.”
- Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts (2019, background): “com/MAIAN-tool/MAIAN 15 Manticore [30] https://github.com/trailofbits/manticore/ 16 Mythril [31] https://github.com/ConsenSys/mythril-classic 17 Octopus https://github.com/quoscient/octopus 18 Osiris [40] https://github.com/christoftorres/Osiris 19 Oyente [27] https://github.com/melonproject/oyente ”
- sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts (2020, methodology): “p and Rossow presented teEther, which is focused on financial transactions and related vulnerabilities.In[25],Nikolicetal.presentedatoolnamedMAIAN, which can find 3 types of trace vulnerabilities. In [29], Torres et al. presented Osiris, a tool which combines symbolic execution and taint analysis to”
- Survey on blockchain based smart contracts: Applications, opportunities and challenges (2021, methodology): “• Specialized testing frameworks [258] • Automated software testing • AI powered software testing • Improved software practices [259],[260] • Specialized bug detection tools [261], [262] , [263] • Bug classification [48]”