What are the Actual Flaws in Important Smart Contracts (and How Can We Find Them)?
What are the Actual Flaws in Important Smart Contracts (and How Can We Find Them)?
复制标题
重要智能合约的实际缺陷是什么（以及我们如何找到它们）？
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Michael Colburn
中科院分区：
文献类型：
--
作者：
Alex Groce;Josselin Feist;Gustavo Grieco;Michael Colburn
智能合同安全中的一个重要问题是了解合同中发现或潜在弱点的可能性和危害性。在本文中，我们提供了对23个专业利益相关者执行的以太智能合同审计的摘要，避免了低质量合同中普遍存在的报告问题的常见问题。这些审计是由区块链安全领域的一家领先公司进行的，使用了开源和专有工具，以及由专业安全工程师执行的人工代码分析。我们对246个单独的缺陷进行了分类，从而可以比较不同漏洞类型的严重性和频率，比较智能合同和非智能合同缺陷，并评估自动漏洞检测方法的效率。
An important problem in smart contract security is understanding the likelihood and criticality of discovered, or potential, weaknesses in contracts. In this paper we provide a summary of Ethereum smart contract audits performed for 23 professional stakeholders, avoiding the common problem of reporting issues mostly prevalent in low-quality contracts. These audits were performed at a leading company in blockchain security, using both open-source and proprietary tools, as well as human code analysis performed by professional security engineers. We categorize 246 individual defects, making it possible to compare the severity and frequency of different vulnerability types, compare smart contract and non-smart contract flaws, and to estimate the efficacy of automated vulnerability detection approaches.