Write a Blog >>
ASE 2020
Mon 21 - Fri 25 September 2020 Melbourne, Australia
Thu 24 Sep 2020 09:10 - 09:30 at Kangaroo - Software Security and Trust (2) Chair(s): Raula Gaikovina Kula

Reentrancy bugs, one of the most severe vulnerabilities in smart contracts, has caused huge financial loss in recent years. Researchers have proposed general-purpose and rule-based approaches to detecting them. However, empirical studies have shown that they usually suffer from undesirable false positives and false negatives, especially when the code under detection involves the interaction between multiple smart contracts. In this paper, we propose an accurate and efficient cross-contract reentracy detection approach in practice. Rather than design rule-of-thumb heuristics, we conduct a large empirical study of 11714 real-world contracts from Etherscan against three well-known general-purpose security tools for reentrancy detection. We manually summarized the reentrancy scenarios where state-of-the-art approaches cannot address. Based on the empirical evidence, we present Clairvoyance, a cross-function and cross-contract static analysis to detect reentrancy vulnerabilities in real world with significantly higher accuracy. To reduce false negatives, we enable, for the first time, a cross-contract call chain analysis by tracking possibly tainted paths. To reduce false positives, we systematically summarized five major path protective techniques (PPTs) to support fast yet precise path feasibility checking. We implemented our approach and compared Clairvoyance with five state-of-the-art tools on 17770 real-worlds contracts. The results show that Clairvoyance yields the best detection accuracy among all the tools and also finds 101 unknown reentrancy vulnerabilities.

Thu 24 Sep

Displayed time zone: (UTC) Coordinated Universal Time change

09:10 - 10:10
Software Security and Trust (2)Tool Demonstrations / Research Papers / Industry Showcase at Kangaroo
Chair(s): Raula Gaikovina Kula NAIST
09:10
20m
Talk
Cross-Contract Static Analysis for Detecting Practical Reentrancy Vulnerabilities in Smart Contracts
Research Papers
Yinxing Xue , Mingliang Ma University of Science and Technology of China, Yun Lin National University of Singapore, Yulei Sui University of Technology Sydney, Australia, Jiaming Ye University of Science and Technology of China, Tianyong Peng University of Science and Technology of China
09:30
20m
Talk
Code-based Vulnerability Detection in Node.js Applications: How far are we?
Industry Showcase
Bodin Chinthanet Nara Institute of Science and Technology, Serena Elisa Ponta SAP Security Research, Henrik Plate SAP Security Research, Antonino Sabetta SAP Security Research, Raula Gaikovina Kula NAIST, Takashi Ishio Nara Institute of Science and Technology, Kenichi Matsumoto Nara Institute of Science and Technology
09:50
10m
Talk
SmartBugs: A Framework to Analyze Solidity Smart Contracts
Tool Demonstrations
João F. Ferreira INESC-ID and IST, University of Lisbon, Pedro Cruz IST, University of Lisbon, Portugal, Thomas Durieux KTH Royal Institute of Technology, Sweden, Rui Abreu Faculty of Engineering, University of Porto, Portugal
DOI