Turn the Rudder: A Beacon of Reentrancy Detection for Smart Contracts on Ethereum
Smart contracts are programs deployed on a blockchain and are immutable once deployed. Reentrancy, one of the most important vulnerabilities in smart contracts, has caused millions of dollars in financial loss. Many reentrancy detection approaches have been proposed. It is necessary to investigate the performance of these approaches to provide useful guidelines for their application. In this work, we conduct a large-scale empirical study on the capability of five well-known or recent reentrancy detection tools such as Mythril and Sailfish. We collect 230,548 verified smart contracts from Etherscan and use detection tools to analyze 139,424 contracts after deduplication, which results in 21,212 contracts with reentrancy issues. Then, we manually examine the defective functions located by the tools in the contracts. From the examination results, we obtain 34 true positive contracts with reentrancy and 21,178 false positive contracts without reentrancy. We also analyze the causes of the true and false positives. Finally, we evaluate the tools based on the two kinds of contracts. The results show that more than 99.8% of the reentrant contracts detected by the tools are false positives with eight types of causes, and the tools can only detect the reentrancy issues caused by call.value(), 58.8% of which can be revealed by the Ethereum’s official IDE, Remix. Furthermore, we collect real-world reentrancy attacks reported in the past two years and find that the tools fail to find any issues in the corresponding contracts. Based on the findings, existing works on reentrancy detection appear to have very limited capability, and researchers should turn the rudder to discover and detect new reentrancy patterns except those related to call.value().
Wed 17 MayDisplayed time zone: Hobart change
11:00 - 12:30 | Blockchain/smart contractsTechnical Track / DEMO - Demonstrations / SEIP - Software Engineering in Practice / Journal-First Papers at Meeting Room 106 Chair(s): Yi Li Nanyang Technological University | ||
11:00 15mTalk | SmartMark: Software Watermarking Scheme for Smart Contracts Technical Track Taeyoung Kim Sungkyunkwan University, Yunhee Jang Sungkyunkwan University, Chanjong Lee Sungkyunkwan University, Hyungjoon Koo Sungkyunkwan University, hyoungshick kim Sungkyunkwan University | ||
11:15 15mTalk | Turn the Rudder: A Beacon of Reentrancy Detection for Smart Contracts on Ethereum Technical Track Zibin Zheng School of Software Engineering, Sun Yat-sen University, Neng Zhang School of Software Engineering, Sun Yat-sen University, Jianzhong Su Sun Yat-sen University, Zhijie Zhong School of Software Engineering, Sun Yat-sen University, Mingxi Ye Sun Yat-sen University, Jiachi Chen School of Software Engineering, Sun Yat-sen University Pre-print | ||
11:30 15mTalk | BSHUNTER: Detecting and Tracing Defects of Bitcoin Scripts Technical Track Peilin Zheng Sun Yat-sen University, Xiapu Luo The Hong Kong Polytechnic University, Zibin Zheng School of Software Engineering, Sun Yat-sen University Pre-print File Attached | ||
11:45 15mTalk | DAppHunter: Identifying Inconsistent Behaviors of Blockchain-based Decentralized Applications SEIP - Software Engineering in Practice Jianfei Zhou University of Electronic Science and Technology of China, Jiang Tianxing , Haijun Wang Ant Group, Meng Wu Ant Group, Ting Chen University of Electronic Science and Technology of China | ||
12:00 15mTalk | Evolutionary Approach for Concurrency Testing of Ripple Blockchain Consensus Algorithm SEIP - Software Engineering in Practice Martijn van Meerten Delft University of Technology, Burcu Kulahcioglu Ozkan Delft University of Technology, Annibale Panichella Delft University of Technology | ||
12:15 7mTalk | Siguard: Detecting Signature-Related Vulnerabilities in Smart Contracts DEMO - Demonstrations Jiashuo Zhang Peking University, China, Yue Li Peking University, Jianbo Gao Peking University, Zhi Guan Peking University, Zhong Chen | ||
12:22 7mTalk | Storage State Analysis and Extraction of Ethereum Blockchain Smart Contracts Journal-First Papers Maha Ayub Information Technology University (ITU) Lahore, Pakistan, Tania Saleem Information Technology University (ITU) Lahore, Pakistan, Muhammad Umar Janjua Information Technology University (ITU) Lahore, Pakistan, Talha Ahmed Information Technology University (ITU) Lahore, Pakistan |