Smart Contract: Attacks and Protections
Smart contracts are programs that reside within decentralized blockchains and are executed pursuant to triggered instructions. A smart contract acts in a similar way to a traditional agreement but negates the necessity for the involvement of a third party. Smart contracts are capable of initiating t...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8976179/ |
| _version_ | 1819169950016733184 |
|---|---|
| author | Sarwar Sayeed Hector Marco-Gisbert Tom Caira |
| author_facet | Sarwar Sayeed Hector Marco-Gisbert Tom Caira |
| author_sort | Sarwar Sayeed |
| collection | DOAJ |
| description | Smart contracts are programs that reside within decentralized blockchains and are executed pursuant to triggered instructions. A smart contract acts in a similar way to a traditional agreement but negates the necessity for the involvement of a third party. Smart contracts are capable of initiating their commands automatically, thus eliminating the involvement of a regulatory body. As a consequence of blockchain's immutable feature, smart contracts are developed in a manner that is distinct from traditional software. Once deployed to the blockchain, a smart contract cannot be modified or updated for security patches, thus encouraging developers to implement strong security strategies before deployment in order to avoid potential exploitation at a later time. However, the most recent dreadful attacks and the multifarious existing vulnerabilities which result as a consequence of the absence of security patches have challenged the sustainability of this technology. Attacks such as the Decentralized Autonomous Organization (DAO) attack and the Parity Wallet hack have cost millions of dollars simply as a consequence of naïve bugs in the smart contract code. In this paper, we classify blockchain exploitation techniques into 4 categories based on the attack rationale; attacking consensus protocols, bugs in the smart contract, malware running in the operating system, and fraudulent users. We then focus on smart contract vulnerabilities, analyzing the 7 most important attack techniques to determine the real impact on smart contract technology. We reveal that even adopting the 10 most widely used tools to detect smart contract vulnerabilities, these still contain known vulnerabilities, providing a dangerously false sense of security. We conclude the paper with a discussion about recommendations and future research lines to progress towards a secure smart contract solution. |
| first_indexed | 2024-12-22T19:27:38Z |
| format | Article |
| id | doaj.art-f9b15b0bd8814d059e6efd23f817a1bb |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-22T19:27:38Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-f9b15b0bd8814d059e6efd23f817a1bb2022-12-21T18:15:12ZengIEEEIEEE Access2169-35362020-01-018244162442710.1109/ACCESS.2020.29704958976179Smart Contract: Attacks and ProtectionsSarwar Sayeed0https://orcid.org/0000-0002-9164-7672Hector Marco-Gisbert1https://orcid.org/0000-0001-6976-5763Tom Caira2https://orcid.org/0000-0002-2855-8212School of Computing, Engineering and Physical Sciences, University of the West of Scotland, Paisley, U.K.School of Computing, Engineering and Physical Sciences, University of the West of Scotland, Paisley, U.K.School of Computing, Engineering and Physical Sciences, University of the West of Scotland, Paisley, U.K.Smart contracts are programs that reside within decentralized blockchains and are executed pursuant to triggered instructions. A smart contract acts in a similar way to a traditional agreement but negates the necessity for the involvement of a third party. Smart contracts are capable of initiating their commands automatically, thus eliminating the involvement of a regulatory body. As a consequence of blockchain's immutable feature, smart contracts are developed in a manner that is distinct from traditional software. Once deployed to the blockchain, a smart contract cannot be modified or updated for security patches, thus encouraging developers to implement strong security strategies before deployment in order to avoid potential exploitation at a later time. However, the most recent dreadful attacks and the multifarious existing vulnerabilities which result as a consequence of the absence of security patches have challenged the sustainability of this technology. Attacks such as the Decentralized Autonomous Organization (DAO) attack and the Parity Wallet hack have cost millions of dollars simply as a consequence of naïve bugs in the smart contract code. In this paper, we classify blockchain exploitation techniques into 4 categories based on the attack rationale; attacking consensus protocols, bugs in the smart contract, malware running in the operating system, and fraudulent users. We then focus on smart contract vulnerabilities, analyzing the 7 most important attack techniques to determine the real impact on smart contract technology. We reveal that even adopting the 10 most widely used tools to detect smart contract vulnerabilities, these still contain known vulnerabilities, providing a dangerously false sense of security. We conclude the paper with a discussion about recommendations and future research lines to progress towards a secure smart contract solution.https://ieeexplore.ieee.org/document/8976179/Smart contractsattack techniquesDAppEthereumvulnerability |
| spellingShingle | Sarwar Sayeed Hector Marco-Gisbert Tom Caira Smart Contract: Attacks and Protections IEEE Access Smart contracts attack techniques DApp Ethereum vulnerability |
| title | Smart Contract: Attacks and Protections |
| title_full | Smart Contract: Attacks and Protections |
| title_fullStr | Smart Contract: Attacks and Protections |
| title_full_unstemmed | Smart Contract: Attacks and Protections |
| title_short | Smart Contract: Attacks and Protections |
| title_sort | smart contract attacks and protections |
| topic | Smart contracts attack techniques DApp Ethereum vulnerability |
| url | https://ieeexplore.ieee.org/document/8976179/ |
| work_keys_str_mv | AT sarwarsayeed smartcontractattacksandprotections AT hectormarcogisbert smartcontractattacksandprotections AT tomcaira smartcontractattacksandprotections |