We investigate a family of bugs in blockchain-based smart contracts, which we call event-ordering (or EO) bugs. These bugs are intimately related to the dynamic ordering of contract events, i.e., calls of its functions, and enable potential exploits of millions of USD worth of virtual coins. Known examples of such bugs and prior techniques to detect them have been restricted to a small number of event orderings, typicall 1 or 2. Our work provides a new formulation of this general class of EO bugs as finding concurrency properties arising in long permutations of such events.
The technical challenge in detecting our formulation of EO bugs in deployed contract on a blockchain such as Ethereum is the inherent combinatorial blowup in path and state space analysis, even for simple contracts. We propose the first use of partial-order reduction techniques, using happen-before relations extracted automatically forcontracts, along with several other optimizations built on dynamic symbolic execution techniques. We build an automatic analysis tool called EthRacer that requires no hints from users and runs directly on Ethereum bytecode. It flags $8%$ of over ten thousand contracts analyzed in few minutes per contract, providing compact event traces (witnesses) that human analysts can run concretely.
Fri 19 Jul Times are displayed in time zone: Beijing, Chongqing, Hong Kong, Urumqi change
16:00 - 17:30: PotpourriTechnical Papers at Grand Ballroom Chair(s): Andreas ZellerCISPA Helmholtz Center for Information Security | |||
16:00 - 16:22 Talk | Semantic Fuzzing with Zest Technical Papers Rohan PadhyeUniversity of California, Berkeley, Caroline LemieuxUniversity of California, Berkeley, Koushik SenUniversity of California, Berkeley, Mike PapadakisUniversity of Luxembourg, Yves Le TraonUniversity of Luxembourg Link to publication DOI Pre-print | ||
16:22 - 16:45 Talk | Detecting Memory Errors at Runtime with Source-Level Instrumentation Technical Papers Zhe ChenNanjing University of Aeronautics and Astronautics, Junqi YanNanjing University of Aeronautics and Astronautics, Shuanglong KanNanjing University of Aeronautics and Astronautics, Ju QianNanjing University of Aeronautics and Astronautics, Jingling XueUNSW Sydney | ||
16:45 - 17:07 Talk | Optimal Context-Sensitive Dynamic Partial Order Reduction with Observers Technical Papers Elvira Albert, Maria Garcia de la BandaMonash University, Miguel Gómez-ZamalloaComplutense University of Madrid, Miguel IsabelComplutense University of Madrid, Peter J. StuckeyMonash University | ||
17:07 - 17:30 Talk | Exploiting The Laws of Order in Smart Contracts Technical Papers Aashish Kolluri, Ivica NikolicNational University Of Singapore, Ilya SergeyYale-NUS College and National University of Singapore, Aquinas Hobor, Prateek SaxenaNational University Of Singapore |