Smart Contract Security: A Software Lifecycle Perspective

Abstract

Smart contract security is an emerging research area that deals with security issues arising from the execution of smart contracts in a blockchain system. Generally, a smart contract is a piece of executable code that automatically runs on the blockchain to enforce an agreement preset between parties involved in the transaction. As an innovative technology, smart contracts have been applied in various business areas, such as digital asset exchange, supply chains, crowdfunding, and intellectual property. Unfortunately, many security issues in smart contracts have been reported in the media, often leading to substantial financial losses. These security issues pose new challenges to security research because the execution environment of smart contracts is based on blockchain computing and its decentralized nature of execution. Thus far, many partial solutions have been proposed to address specific aspects of these security issues, and the trend is to develop new methods and tools to automatically detect common security vulnerabilities. However, smart contract security is systematic engineering that should be explored from a global perspective, and a comprehensive study of issues in smart contract security is urgently needed. To this end, we conduct a literature review of smart contract security from a software lifecycle perspective. We first analyze the key features of blockchain that can cause security issues in smart contracts and then summarize the common security vulnerabilities of smart contracts. To address these vulnerabilities, we examine recent advances in smart contract security spanning four development phases: 1) security design; 2) security implementation; 3) testing before deployment; and 4) monitoring and analysis. Finally, we outline emerging challenges and opportunities in smart contract security for blockchain engineers and researchers.

Blockchain and COVID-19 Pandemic: Applications and Challenges

“…Despite many advantages of smart contracts such as support for automation, ease of debugging, cost efficiency, and limited human intervention required to run business processes; however, the presence of bugs inside a smart contract code can affect its normal operations that can lead to huge losses and disruptions. Being deployed on a decentralized platform, a smart contract can face several security threats from the pseudonymous malicious actors that can fully control the smart contract for malicious purposes [118][119][120]. Smart contracts deployed on the public blockchain platforms are often open-source.…”

Secure Modular Smart Contract Platform for Multi-Tenant 5G Applications

“…In Ethereum, smart contract vulnerabilities arise from the Solidity language, the Ethereum or EVM blockchain platform, and a misunderstanding of common practices. In Hyperledger Fabric chaincodes, vulnerabilities arise from almost identical points: the Go language, the blockchain platform, and a misunderstanding of common practices [48].…”

“…Common software security weaknesses [26], [49] may be amplified on blockchain platforms and in the related SC security [50]. Such weaknesses include improper behavioral workflow, access control or initialization, incorrect calculation and insufficiently random values, the inclusion of untrusted external functionalities (e.g., external libraries, smart contracts deployed by others), and improper exception handling and cryptographic understanding [48].…”

“…In Hyperledger Fabric chaincode development, Go is most widely used. Most security vulnerabilities in Hyperledger Fabric chaincodes arise from the nondeterministic behavior of Go, which may lead to consensus failure [48]. Apart from this, other vulnerabilities arise from almost identical points as in Ethereum: the blockchain platform and a misunderstanding of common practices.…”

“…According to [48], smart contract security should be explored from a global perspective and reaching beyond merely analyzing the smart contract code for possible vulnerabilities and flaws. They refer to four development phases, which all contribute to SC security: i. security design, ii.…”