Automated Generation of Test Cases for Smart Contract Security Analyzers

Abstract

We address the absence of reliable tests on contract analyzers of smart contracts and present a systematic method to diversify test cases by combining smart-contract-specific bugs and static analysis barriers in this paper. Using contract analyzers is the most practical solution for building a secure blockchain service, but they are relatively immature and lacking stable performance metrics. Traditionally, performance reports only compare static contract analyzers with pre-defined test cases, such as the Juliet test suite. However, building such test suites is burdensome for smart contracts, which are frequently change. In this paper, we propose an automated method to assess contract analyzers of smart contracts by diversifying test cases. In the experimental results, we identified nine erroneous alarms in the state-of-the-art contract analyzers with automatically generated test cases on five vulnerabilities.

Continuous and Secure Integration Framework for Smart Contracts

“…A smart contract is, as previously stated, an immutable software code that runs on top of the blockchain. Currently, Ethereum is the most popular blockchain for smart contracts [ 15 ], but other blockchains with smart contract support are shown in recent studies [ 40 ].…”

“…For this reason, the distributed fashion of blockchain creates particular requirements for elaborating the contracts [ 12 , 13 ]. As shown in [ 14 ], constant changes in the DevOps process can cause unexpected delays, which can be a big issue in the case of smart contracts, given that the language is changing fast [ 15 ] and with it, the need to implement new and more complete tools and development strategies. However, the viability of implementing a few steps of DevOps on an Ethereum blockchain has been proven by Wöhrer, and Zdun [ 16 ].…”

Smart contract reentrancy vulnerability detection method based on manifold pigeon optimization algorithm

“…Jiang 等人 [13] 则设计了一款 基于模糊分析的工具 Contracufuzzer, 用于检测 Ethereum 智能合约的安全漏洞. Kim [43] 提出了一种为 智能合约分析工具自动生成测试用例的方法, 辅助工 具检测重入性漏洞. 然而, 如果生成的测试用例中不 包含重入性循环路径, 则可能导致检测误差.…”

Talaria: A Framework for Simulation of Permissioned Blockchains for Logistics and Beyond

“…There have been recent advances in automated generation of test cases, models for formal verification of security properties, and methodologies for practical security analyses for smart contracts. Nonetheless, several high-profile failures to achieve safety have resulted in some negative perception of the safety of blockchain systems [18]- [20]. These concerns for safety have been amplified by existing bottlenecks in the throughput of several blockchain systems [17], [21].…”