ICSE 2024
Fri 12 - Sun 21 April 2024 Lisbon, Portugal
Fri 19 Apr 2024 11:45 - 12:00 at Eugénio de Andrade - Security 4 Chair(s): Liliana Pasquale

To empower smart contracts with the promising capabilities of cryptography, Ethereum officially introduced a set of cryptographic APIs that facilitate basic cryptographic operations within smart contracts, such as elliptic curve operations. However, since developers are not necessarily cryptography experts, requiring them to directly interact with these basic APIs has caused real-world security issues and potential usability challenges. To guide future research and solutions to these challenges, we conduct the first empirical study on Ethereum cryptographic practices. Through the analysis of 91,484,856 Ethereum transactions, 500 crypto-related contracts, and 483 StackExchange posts, we provide the first in-depth look at cryptographic tasks developers need to accomplish and identify five categories of obstacles they encounter. Furthermore, we conduct an online survey with 78 smart contract practitioners to explore their perspectives on these obstacles and elicit the underlying reasons. We find that more than half of practitioners face more challenges in cryptographic tasks compared to general business logic in smart contracts. Their feedback highlights the gap between low-level cryptographic APIs and high-level tasks they need to accomplish, emphasizing the need for improved cryptographic APIs, task-based templates, and effective assistance tools. Based on these findings, we provide practical implications for further improvements and outline future research directions.

Fri 19 Apr

Displayed time zone: Lisbon change

11:00 - 12:30
Security 4Research Track / Software Engineering in Practice at Eugénio de Andrade
Chair(s): Liliana Pasquale University College Dublin & Lero
11:00
15m
Talk
A User-centered Security Evaluation of Copilot
Research Track
Owura Asare University of Waterloo, Mei Nagappan University of Waterloo, N. Asokan University of Waterloo
11:15
15m
Talk
Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities
Research Track
Susheng Wu Fudan University, Wenyan Song Fudan University, Kaifeng Huang Tongji University, Bihuan Chen Fudan University, Xin Peng Fudan University
11:30
15m
Talk
Understanding Transaction Bugs in Database Systems
Research Track
Ziyu Cui Institute of Software Chinese Academy of Sciences, Wensheng Dou Institute of Software Chinese Academy of Sciences, Yu Gao Institute of Software, Chinese Academy of Sciences, China, Dong Wang Institute of software, Chinese academy of sciences, Jiansen Song Institute of Software Chinese Academy of Sciences, Yingying Zheng Institute of Software Chinese Academy of Sciences, Tao Wang Institute of Software at Chinese Academy of Sciences, Rui Yang Institute of Software, Chinese Academy of Sciences, Kang Xu University of Chinese Academy of Sciences, Nanjing, Yixin Hu Sun Yat-sen University, Jun Wei Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences; University of Chinese Academy of Sciences Chongqing School, Tao Huang Institute of Software Chinese Academy of Sciences
Pre-print
11:45
15m
Talk
When Contracts Meets Crypto: Exploring Developers' Struggles with Ethereum Cryptographic APIs
Research Track
Jiashuo Zhang Peking University, China, Jiachi Chen Sun Yat-sen University, Zhiyuan Wan Zhejiang University, Ting Chen University of Electronic Science and Technology of China, Jianbo Gao Peking University, Zhong Chen
12:00
15m
Talk
Industrial Challenges in Secure Continuous Development
Software Engineering in Practice
Fabiola Moyón Siemens Technology and Technical University of Munich, Florian Angermeir fortiss GmbH, Daniel Mendez Blekinge Institute of Technology and fortiss
Pre-print
12:15
15m
Talk
Automated Security Findings Management: A Case Study in Industrial DevOps
Software Engineering in Practice
Markus Voggenreiter Siemens Technology / LMU Munich, Florian Angermeir fortiss GmbH, Fabiola Moyón Siemens Technology and Technical University of Munich, Ulrich Schöpp fortiss GmbH, Pierre Bonvin Munich University of Applied Sciences
Pre-print