Characterizing Code Clones in the Ethereum Smart Contract Ecosystem

He, Ningyu; Wu, Lei; Wang, Haoyu; Guo, Yao; Jiang, Xuxian

doi:10.48550/arxiv.1905.00272

Cited by 11 publications

(14 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Kalra et al [46] provided a static analysis tool to detect vulnerable smart contracts based on LLVM. He et al [44] characterized code-clone based vulnerabilities in Ethereum smart contracts. Regarding EO-SIO, however, most are reports [1,4,5,20,31,32] focusing on attack/vulnerability analyses by security companies; only a few academic publications [48,56] are available.…”

Section: Related Workmentioning

confidence: 99%

Characterizing EOSIO Blockchain

Huang,

Wang,

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

EOSIO has become one of the most popular blockchain platforms since its mainnet launch in June 2018. In contrast to the traditional PoW-based systems (e.g., Bitcoin and Ethereum), which are limited by low throughput, EOSIO is the first high throughput Delegated Proof of Stake system that has been widely adopted by many applications. Although EOSIO has millions of accounts and billions of transactions, little is known about its ecosystem, especially related to security and fraud. In this paper, we perform a large-scale measurement study of the EOSIO blockchain and its associated DApps. We gather a large-scale dataset of EOSIO and characterize activities including money transfers, account creation and contract invocation. Using our insights, we then develop techniques to automatically detect bots and fraudulent activity. We discover thousands of bot accounts (over 30% of the accounts in the platform) and a number of real-world attacks (301 attack accounts). By the time of our study, 80 attack accounts we identified have been confirmed by DApp teams, causing 828,824 EOS tokens losses (roughly 2.6 million US$) in total.

show abstract

Section: Related Workmentioning

confidence: 99%

Characterizing EOSIO Blockchain

Huang,

Wang,

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Vulnerability Detection of Ethereum Smart Contracts Ethereum has received lots of attention from academia, and a number of studies were focused on the vulnerability detection [9]- [16], [48]- [51]. For example, [13], [50], [51] were mainly focused on the overflow problem in Ethereum smart contracts.…”

Section: Related Workmentioning

confidence: 99%

“…Unfortunately, most smart contracts on EOSIO are not opensourced, and there are few analysis tools towards analyzing the Wasm bytecode, which makes it more difficult to detect vulnerabilities for EOSIO smart contracts automatically. Although many efforts have been made to analyze the Ethereum smart contracts by the community [9]- [16], none of them, however, can be applied to EOSIO smart contracts, as these two ecosystems are totally different, ranging from the virtual machine, the structure of bytecode, to the types of vulnerabilities.…”

Section: Introductionmentioning

confidence: 99%

Security Analysis of EOSIO Smart Contracts

He¹,

Zhang²,

Wu³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

The EOSIO blockchain, one of the representative Delegated Proof-of-Stake (DPoS) blockchain platforms, has grown rapidly recently. Meanwhile, a number of vulnerabilities and high-profile attacks against top EOSIO DApps and their smart contracts have also been discovered and observed in the wild, resulting in serious financial damages. Most of EOSIOs smart contracts are not open-sourced and they are typically compiled to WebAssembly (Wasm) bytecode, thus making it challenging to analyze and detect the presence of possible vulnerabilities. In this paper, we propose EOSAFE, the first static analysis framework that can be used to automatically detect vulnerabilities in EOSIO smart contracts at the bytecode level. Our framework includes a practical symbolic execution engine for Wasm, a customized library emulator for EOSIO smart contracts, and four heuristics-driven detectors to identify the presence of four most popular vulnerabilities in EOSIO smart contracts. Experiment results suggest that EOSAFE achieves promising results in detecting vulnerabilities, with an F1-measure of 98%. We have applied EOSAFE to all active 53,666 smart contracts in the ecosystem (as of November 15, 2019). Our results show that over 25% of the smart contracts are vulnerable. We further analyze possible exploitation attempts against these vulnerable smart contracts and identify 48 in-the-wild attacks (25 of them have been confirmed by DApp developers), resulting in financial loss of at least 1.7 million USD.

show abstract

“…Norvill et al proposed a framework to group together similar contracts within the Ethereum network, and further automate labeling unknown contracts [45]. He et al performed a detailed similarity comparison of a large number of contracts to investigate the correlation between code reuse and vulnerabilities [46]. In addition, finding similar contracts is helpful to develop new contracts.…”

Section: B Smart Contract Analysismentioning

confidence: 99%

XBlock-EOS: Extracting and Exploring Blockchain Data From EOSIO

Zheng¹,

Zheng²,

Dai

et al. 2020

Preprint

View full text Add to dashboard Cite

Blockchain-based cryptocurrencies and applications have flourished the blockchain research community. Massive data generated from diverse blockchain systems bring not only huge business values and but also technical challenges in data analytics of heterogeneous blockchain data. Different from Bitcoin and Ethereum, EOSIO has richer diversity and higher volume of blockchain data due to its unique architectural design in resource management, consensus scheme and high throughput. Despite its popularity (e.g., 89,800,000 blocks generated till Nov. 14, 2019 since its launching in June 8, 2018), few studies have been made on data analysis of EOSIO. To fill this gap, we collect and process the up-to-date on-chain data from EOSIO. We name these well-processed EOSIO datasets as XBlock-EOS, which consists of 7 well-processed datasets: 1) Block, Transaction and Action, 2) Internal and External EOS Transfer Action, 3) Contract Information, 4) Contract Invocation, 5) Token Action, 6) Account Creation, 7) Resource Management. It is challenging to process and analyze high volume of raw EOSIO data and establish the mapping from original raw data to the fine-grained datasets since it requires substantial efforts in exacting various types of data as well as sophisticated knowledge on software engineering and data analytics. Meanwhile, we present statistics and exploration on these datasets. Moreover, we also outline the possible research opportunities based on XBlock-EOS.

show abstract

Characterizing Code Clones in the Ethereum Smart Contract Ecosystem

Cited by 11 publications

References 25 publications

Characterizing EOSIO Blockchain

Characterizing EOSIO Blockchain

Security Analysis of EOSIO Smart Contracts

XBlock-EOS: Extracting and Exploring Blockchain Data From EOSIO

Contact Info

Product

Resources

About