MadMax: Analyzing the Out-of-Gas World of Smart Contracts.
Ethereum is a distributed blockchain platform, serving as an ecosystem for smart contracts: full-fledged intercommunicating programs that capture the transaction logic of an account. A gas limit caps the execution of an Ethereum smart contract: instructions, when executed, consume gas, and the execu...
| Publicado en: | Communications of the ACM Vol. 63; no. 10; pp. 87 - 96 |
|---|---|
| Autores principales: | , , , , , |
| Formato: | Artículo |
| Publicado: |
Association for Computing Machinery
Oct2020
|
| Materias: | |
| Acceso en línea: | Ver este registro en EBSCOhost |
| fields | @attributes: recordID: 1 pdfLink: plink: https://search.ebscohost.com/login.aspx?direct=true&db=hlh&AN=146056008&site=ehost-live header: @attributes: shortDbName: hlh uiTerm: 146056008 longDbName: Humanities International Complete uiTag: AN controlInfo: bkinfo: jinfo: jid: 00010782 ACM jtl: Communications of the ACM issn: 00010782 maglogo: N pubinfo: dt: Oct2020 vid: 63 iid: 10 pid: 68 pub: Association for Computing Machinery artinfo: ui: 146056008 10.1145/3416262 ppf: 87 ppct: 9 formats: tig: atl: MadMax: Analyzing the Out-of-Gas World of Smart Contracts. aug: au: Grech, Neville Kong, Michael Jurisevic, Anton Brent, Lexi Scholz, Bernhard Smaragdakis, Yannis affil: University of Athens, Greece University of Sydney, Australia su: Electronic contracts Computer security vulnerabilities Computer crime prevention Blockchains Decompilers (Computer programs) sug: subj: Electronic contracts Computer security vulnerabilities Computer crime prevention Blockchains Decompilers (Computer programs) ab: Ethereum is a distributed blockchain platform, serving as an ecosystem for smart contracts: full-fledged intercommunicating programs that capture the transaction logic of an account. A gas limit caps the execution of an Ethereum smart contract: instructions, when executed, consume gas, and the execution proceeds as long as gas is available. Gas-focused vulnerabilities permit an attacker to force key contract functionality to run out of gas-effectively performing a permanent denial-of-service attack on the contract. Such vulnerabilities are among the hardest for programmers to protect against, as out-of-gas behavior may be uncommon in nonattack scenarios and reasoning about these vulnerabilities is nontrivial. In this paper, we identify gas-focused vulnerabilities and present MadMax: a static program analysis technique that automatically detects gas-focused vulnerabilities with very high confidence. MadMax combines a smart contract decompiler and semantic queries in Datalog. Our approach captures high-level program modeling concepts (such as "dynamic data structure storage" and "safely resumable loops") and delivers high precision and scalability. MadMax analyzes the entirety of smart contracts in the Ethereum blockchain in just 10 hours and flags vulnerabilities in contracts with a monetary value in billions of dollars. Manual inspection of a sample of flagged contracts shows that 81% of the sampled warnings do indeed lead to vulnerabilities. pubtype: Periodical doctype: Article src: R language: English refInfo: copyright: @attributes: flag: Y dt: @attributes: year: 2020 holdings: @attributes: islocal: N |
|---|