BCRA 2024
Fri 26 - Sat 27 July 2024 Hangzhou, China
Fri 26 Jul 2024 11:30 - 11:45 at The ballroom B - Session 1 - Smart Contract Security Chair(s): Ruidong Zhang

With the increasing popularity of cryptocurrencies and blockchain technology, smart contracts have become a prominent feature in developing decentralized applications. However, these smart contracts are susceptible to vulnerabilities that hackers can exploit, resulting in significant financial losses. In response to this growing concern, various initiatives have emerged. Notably, the SWC vulnerability list played an important role in raising awareness and understanding of smart contract weaknesses. However, the SWC list lacks maintenance and has not been updated with new vulnerabilities since 2020. To address this gap, this paper introduces the Smart Contract Weakness Enumeration (SWE), a comprehensive and practical vulnerability list up until 2023. We collect 273 vulnerability descriptions from 86 top conference papers and journal papers, employing open card sorting techniques to deduplicate and categorize these descriptions. This process results in the identification of 40 common contract weaknesses, which are further classified into 20 sub-research fields through thorough discussion and analysis. SWE provides a systematic and comprehensive list of smart contract vulnerabilities, covering existing and emerging vulnerabilities in the last few years. Moreover, SWE is a scalable, continuously iterative program. We propose two update mechanisms for the maintenance of SWE. Regular updates involve the inclusion of new vulnerabilities from future top papers, while irregular updates enable individuals to report new weaknesses for review and potential addition to SWE.

Fri 26 Jul

Displayed time zone: Beijing, Chongqing, Hong Kong, Urumqi change

10:45 - 12:00
Session 1 - Smart Contract SecurityResearch Track at The ballroom B
Chair(s): Ruidong Zhang University of Wisconsin-Eau Claire
10:45
15m
Paper
ACOFuzz: an Ant Colony Algorithm-based Fuzzer for Smart Contracts
Research Track
Peixuan Feng Henan Key Laboratory of Network Cryptography Technology, Wenrui Cao Henan Key Laboratory of Network Cryptography Technology, Siqi Lu Henan Key Laboratory of Network Cryptography Technology, Yongjuan Wang Henan Key Laboratory of Network Cryptography Technology, Haoyuan Xue Henan Key Laboratory of Network Cryptography Technology, Runnan Yang Henan Armed Police Corps Hospital
11:00
15m
Paper
DelegateTracker: Delegatecall Vulnerability Detection Tool Based on Read-Write Data Flow Capture Algorithm
Research Track
Peixuan Feng Henan Key Laboratory of Network Cryptography Technology, Wenrui Cao Henan Key Laboratory of Network Cryptography Technology, Siqi Lu Henan Key Laboratory of Network Cryptography Technology, Yongjuan Wang Henan Key Laboratory of Network Cryptography Technology, Xiangyu Wang Henan Key Laboratory of Network Cryptography Technology, Runnan Yang Henan Armed Police Corps Hospital
11:15
15m
Paper
SoK: On the Security of Non-Fungible Tokens
Research Track
Kai Ma , Jintao Huang Huazhong University of Science and Technology, Ningyu He Peking University, Zhuo Wang , Haoyu Wang Huazhong University of Science and Technology
11:30
15m
Paper
To Healthier Ethereum: A Comprehensive and Iterative Smart Contract Weakness Enumeration
Research Track
Jiachi Chen Sun Yat-sen University, Mingyuan Huang Sun Yat-sen University, Zewei Lin Sun Yat-sen University, Peilin Zheng Sun Yat-sen University, Zibin Zheng Sun Yat-sen University
11:45
15m
Paper
DeFi Risk Assessment: MakerDAO Loan Portfolio Case
Research Track
Ignat Melnikov Skolkovo Institute of Science and Technology; Blockchain Laboratory, Sberbank PJSC, Irina Lebedeva Skolkovo Institute of Science and Technology, Blockchain Laboratory, Sberbank PJSC, Artem Petrov Blockchain Laboratory, Sberbank PJSC; Blockchain Department, Moscow Institute of Physics and Technology, Yury Yanovich Skolkovo Institute of Science and Technology; Faculty of Computer Science, HSE University