Aroc: An Automatic Repair Framework for On-Chain Smart Contracts

Abstract

Ongoing smart contract attack events have seriously impeded the practical application of blockchain. Although lots of researches have been conducted, they mostly focus on off-chain vulnerability detection. However, smart contracts cannot be modified once they have been deployed on-chain, thus existing techniques cannot protect those deployed contracts from being attacked. To mitigate this problem, we propose a general smart contract repairer named Aroc, which can automatically patch vulnerable deployed contracts without changing the contract codes. The core insight of Aroc is to generate patch contracts to abort malicious transactions in advance. Taking the three most serious bug types (i.e., reentrancy, arithmetic bugs, and unchecked low-level checks) as examples, we present how Aroc automatically repairs them on-chain. We conduct abundant evaluations on four kinds of datasets to evaluate the effectiveness and efficiency of Aroc. In particular, Aroc can repair 95.95% of the vulnerable contracts with an average correctness ratio of 93.32%. Meanwhile, Aroc introduces acceptable additional overheads to smart contract users and blockchain miners. When compared with the state-of-the-art techniques, Aroc introduces either fewer execution overheads or contract codes.

Smart Contract Design Pattern for Processing Logically Coherent Transaction Types

“…Researchers also propose templates as an alternative way to unify smart contract design. For example, Jin et al [17] developed the Aroc tool, which generates a patch contract containing security rules based on the fixed template and deploys it to the blockchain. Templates are also the subject of other research.…”

Challenges and Opportunities in Smart Contract Development on the Ethereum Virtual Machine: A Systematic Literature Review

“…IEEE 50 20 29 1 [Dharanikota et al 2021], [Dingman et al 2019], [Zeng et al 2022], [Tsiounis and Kontogiannis 2022], [Qasse et al 2021], [Barišić et al 2021], [Feist et al 2019], [Ferreira et al 2020], [Dong et al 2022b], [Jurgelaitis et al 2022], [Garamvölgyi et al 2018], [Chirtoaca et al 2020], [Dong et al 2022a], [Ren et al 2021], [Yu et al 2021], [Akca et al 2019], [Tsai et al 2019], [Bao and Liu 2021], [Jin et al 2022…”

“…Other tools have been proposed to facilitate or innovate in the area of smart contracts, such as in [Santiago et al 2021], where a tool was proposed that allows for the writing of contracts at runtime using models in JSON and Typescript. On the other hand, in [Jin et al 2022], a framework is presented that uses a patching mechanism to repair already deployed smart contracts. The framework works by intercepting calls to the original contract and blocking malicious transactions through another contract.…”

Securing smart contracts with formal verification and automated program repair

“…Elysium [294], sGuard [224], EVMPatch [250], Aroc [158], and HCC [125]. Most of these tools utilize a symbolic execution or static analysis component for a (predefined) vulnerability detection.…”

“…Automated program repair (APR) techniques could be used to automatically fix many of such bugs in the software code. At the same time, the existing research on automated repair of smart contracts is concentrated around template-based patching of common security vulnerabilities, which are detected as (hardcoded) patterns in the code of a smart contract by means of symbolic execution or static analysis [224,334,250,158]. For example, SmartShield [334], employs one of the predefined fixing strategies once one of the three code patterns is identified in the code of a smart contract: it detects state changes performed after an external call, missing checks for overflowing arithmetic operations, or missing checks on the result of a possibly failing external call.…”