When Contracts Meets Crypto: Exploring Developers' Struggles with Ethereum Cryptographic APIs
To empower smart contracts with the promising capabilities of cryptography, Ethereum officially introduced a set of cryptographic APIs that facilitate basic cryptographic operations within smart contracts, such as elliptic curve operations. However, since developers are not necessarily cryptography experts, requiring them to directly interact with these basic APIs has caused real-world security issues and potential usability challenges. To guide future research and solutions to these challenges, we conduct the first empirical study on Ethereum cryptographic practices. Through the analysis of 91,484,856 Ethereum transactions, 500 crypto-related contracts, and 483 StackExchange posts, we provide the first in-depth look at cryptographic tasks developers need to accomplish and identify five categories of obstacles they encounter. Furthermore, we conduct an online survey with 78 smart contract practitioners to explore their perspectives on these obstacles and elicit the underlying reasons. We find that more than half of practitioners face more challenges in cryptographic tasks compared to general business logic in smart contracts. Their feedback highlights the gap between low-level cryptographic APIs and high-level tasks they need to accomplish, emphasizing the need for improved cryptographic APIs, task-based templates, and effective assistance tools. Based on these findings, we provide practical implications for further improvements and outline future research directions.
Fri 19 AprDisplayed time zone: Lisbon change
11:00 - 12:30 | Security 4Research Track / Software Engineering in Practice at Eugénio de Andrade Chair(s): Liliana Pasquale University College Dublin & Lero | ||
11:00 15mTalk | A User-centered Security Evaluation of Copilot Research Track Owura Asare University of Waterloo, Mei Nagappan University of Waterloo, N. Asokan University of Waterloo | ||
11:15 15mTalk | Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities Research Track Susheng Wu Fudan University, Wenyan Song Fudan University, Kaifeng Huang Tongji University, Bihuan Chen Fudan University, Xin Peng Fudan University | ||
11:30 15mTalk | Understanding Transaction Bugs in Database Systems Research Track Ziyu Cui Institute of Software Chinese Academy of Sciences, Wensheng Dou Institute of Software Chinese Academy of Sciences, Yu Gao Institute of Software, Chinese Academy of Sciences, China, Dong Wang Institute of software, Chinese academy of sciences, Jiansen Song Institute of Software Chinese Academy of Sciences, Yingying Zheng Institute of Software Chinese Academy of Sciences, Tao Wang Institute of Software at Chinese Academy of Sciences, Rui Yang Institute of Software, Chinese Academy of Sciences, Kang Xu University of Chinese Academy of Sciences, Nanjing, Yixin Hu Sun Yat-sen University, Jun Wei Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences; University of Chinese Academy of Sciences Chongqing School, Tao Huang Institute of Software Chinese Academy of Sciences Pre-print | ||
11:45 15mTalk | When Contracts Meets Crypto: Exploring Developers' Struggles with Ethereum Cryptographic APIs Research Track Jiashuo Zhang Peking University, China, Jiachi Chen Sun Yat-sen University, Zhiyuan Wan Zhejiang University, Ting Chen University of Electronic Science and Technology of China, Jianbo Gao Peking University, Zhong Chen | ||
12:00 15mTalk | Industrial Challenges in Secure Continuous Development Software Engineering in Practice Fabiola Moyón Siemens Technology and Technical University of Munich, Florian Angermeir fortiss GmbH, Daniel Mendez Blekinge Institute of Technology and fortiss Pre-print | ||
12:15 15mTalk | Automated Security Findings Management: A Case Study in Industrial DevOps Software Engineering in Practice Markus Voggenreiter Siemens Technology / LMU Munich, Florian Angermeir fortiss GmbH, Fabiola Moyón Siemens Technology and Technical University of Munich, Ulrich Schöpp fortiss GmbH, Pierre Bonvin Munich University of Applied Sciences Pre-print |