Compositional Verification of Smart Contracts Through Communication Abstraction

Wesley, Scott; Christakis, Maria; Navas, Jorge A.; Trefler, Richard J.; Wüstholz, Valentin; Gurfinkel, Arie

doi:10.1007/978-3-030-88806-0_21

Cited by 5 publications

(3 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Manuscript submitted to ACM Soundness. The soundness of the methods has been established mathematically for only 5 out of 35 properties, including (i) Preservation of State (Section 5.4.19), (ii) Preservation of Assets (Section 5.4.17), (iii) Deposit Acceptance (Section 5.3.1), (iv) Integer over/underflow Guarding (Section 5.4.12), and (v) some user-specified properties (Section 5.5 (A & D)) and 12 approaches based on static type checking [49,61,152], abstract interpretation [178], symbolic execution [163], model checking [134,218], and theorem proving [15,16,69,157,172]. This observation suggests that there are ample opportunities for further investigation of the utility of mathematical semantic analysis methods in this domain.…”

Section: Emerging Directions and Opportunitiesmentioning

confidence: 99%

Pre-deployment Analysis of Smart Contracts -- A Survey

Munir¹,

Taha²

2023

Preprint

View full text Add to dashboard Cite

Smart contracts are programs that execute transactions involving independent parties and cryptocurrencies. As programs, smart contracts are susceptible to a wide range of errors and vulnerabilities. Such vulnerabilities can result in significant losses. Furthermore, by design, smart contract transactions are irreversible. This creates a need for methods to ensure the correctness and security of contracts pre-deployment. Recently there has been substantial research into such methods. The sheer volume of this research makes articulating state-of-the-art a substantial undertaking. To address this challenge, we present a systematic review of the literature. A key feature of our presentation is to factor out the relationship between vulnerabilities and methods through properties. Specifically, we enumerate and classify smart contract vulnerabilities and methods by the properties they address. The methods considered include static analysis as well as dynamic analysis methods and machine learning algorithms that analyze smart contracts before deployment.Several patterns about the strengths of different methods emerge through this classification process.CCS Concepts: • General and reference → Surveys and overviews; • Software and its engineering → Automated static analysis; Dynamic analysis; Software verification.

show abstract

Section: Emerging Directions and Opportunitiesmentioning

confidence: 99%

Pre-deployment Analysis of Smart Contracts -- A Survey

Munir¹,

Taha²

2023

Preprint

View full text Add to dashboard Cite

show abstract

“…A somewhat related approach to fight state space explosion is modular (or compositional) reasoning [26], whereby a program is analysed by splitting it into components, for instance according to rely-guarantee conditions [34]. This form of compositionality has proved effective in several use cases, such as multi-robot and multi-agent systems [4,33], railway networks [15], smart contracts [48], and authentication protocols [50]. All these applications, like our own work, exploit fully automated verification procedures; other frameworks, such as IVy [38], combine rely-guarantee reasoning with semi-automated procedures.…”

Section: Related Workmentioning

confidence: 99%

Compositional Verification of Stigmergic Collective Systems

Stefano

Lang

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Collective adaptive systems may be broadly defined as ensembles of autonomous agents, whose interaction may lead to the emergence of global features and patterns. Formal verification may provide strong guarantees about the emergence of these features, but may suffer from scalability issues caused by state space explosion. Compositional verification techniques, whereby the state space of a system is generated by combining (an abstraction of) those of its components, have shown to be a promising countermeasure to the state space explosion problem. Therefore, in this work we apply these techniques to the problem of verifying collective adaptive systems with stigmergic interaction. Specifically, we automatically encode these systems into networks of LNT processes, apply a static value analysis to prune the state space of individual agents, and then reuse compositional verification procedures provided by the CADP toolbox. We demonstrate the effectiveness of our approach by verifying a collection of representative systems. ⋆ Work partially funded by ERC consolidator grant no. 772459 D-SynMA (Distributed Synthesis: from Single to Multiple Agents).

show abstract

“…This class of approaches aims to construct abstractions of stochastic systems in a compositional manner such that the relevant properties to be checked will be preserved by the abstraction. The later class of approaches are based on assume-guarantee reasoning provided by probabilistic contracts to reason about the system compositionally [26,267]. Katoen et al [136] propose a framework for aggressive abstraction of interactive Markov chains in a compositional manner exploiting statebased abstraction.…”

Section: Modular Verification Of Stochastic Systemsmentioning

confidence: 99%

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

Skandylas¹

View full text Add to dashboard Cite

Today's software landscape features a high degree of complexity, frequent changes in requirements and stakeholder goals, and uncertainty.Uncertainty and high complexity imply a threat landscape where cybersecurity attacks are a common occurrence while their consequences are often severe. Self-adaptive systems have been proposed to mitigate the complexity and frequent changes by adapting at run-time to deal with situations not known at design time.Self-adaptive systems that aim to identify, analyse and mitigate threats autonomously are called self-protecting systems.This thesis contributes approaches towards developing systems with self-protection capabilities under two perspectives. Under the first perspective, we enhance the security of component-based systems and equip them with self-protection capabilities that reduce the exposedattack surface or provide efficient defenses against identified attacks. We target systems where information about the system components and the adaptationdecisions is available, and control over the adaptation is possible. We employ runtime threat modeling and analysis using quantitative risk analysis and probabilistic verification to rank adaptations to be applied in the system in terms of their security levels. We then introduce modular and incremental verification approaches to tackle the scalability issues of probabilistic verification to be able to analyze larger-scale software systems.To protect against cyberattacks that cannot be mitigated by reducing the exposed attack surface, we propose an approach to analyze the security of different software architectures incorporating countermeasures to decide on the most suitable ones to evolve to. Under the second perspective, we study open decentralized systems where we have limited information about and limited control over the system entities. We employ decentralized information flow control mechanisms to enforce security by controlling the interactions among the system elements.We extend decentralized information flow control by incorporating trust and adding adaptationcapabilities that allow the system to identify security threats and self-organize to maximize trust between the system entities.

show abstract

Compositional Verification of Smart Contracts Through Communication Abstraction

Cited by 5 publications

References 40 publications

Pre-deployment Analysis of Smart Contracts -- A Survey

Pre-deployment Analysis of Smart Contracts -- A Survey

Compositional Verification of Stigmergic Collective Systems

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

Contact Info

Product

Resources

About