VULTRON: Catching Vulnerable Smart Contracts Once and for AllNIER
Despite the high stakes involved, smart contracts are often written in an undisciplined way thus far. The existence of vulnerabilities compromises the security and reliability of smart contracts, and endangers the trust of participants in their ongoing businesses. Existing vulnerability detection techniques are often designed case-by-case, making them difficult to generalize. In this paper, we design general principles for detecting vulnerable smart contracts. Our insight is that almost all the existing transaction related vulnerabilities are due to the mismatch between the actual transferred value and the amount reflected on the contract’s internal bookkeeping. Based on this, we propose a precise and generally applicable technique, VULTRON, which can detect irregular transactions due to various types of adversarial exploits. We also report on preliminary results applying our technique in real-world case studies.
Wed 29 MayDisplayed time zone: Eastern Time (US & Canada) change
11:00 - 12:30 | Security 1Journal-First Papers / Papers / Technical Track / New Ideas and Emerging Results / Software Engineering in Practice at Van-Horne Chair(s): Corina S. Păsăreanu Carnegie Mellon University Silicon Valley, NASA Ames Research Center | ||
11:00 20mTalk | Interventions for Software Security: Creating a Lightweight Program of Assurance Techniques for DevelopersSEIPIndustry Program Software Engineering in Practice Charles Weir Lancaster University, Lynne Blair Lancaster University, Ingolf Becker University College London, M. Angela Sasse University College London, James Noble Victoria University of Wellington, Awais Rashid University of Bristol, UK | ||
11:20 20mTalk | Towards Better Utilizing Static Application Security TestingSEIPIndustry Program Software Engineering in Practice Jinqiu Yang Concordia University, Montreal, Canada, Lin Tan Purdue University, John Peyton HCL America, Kristofer A Duer AppScan Source | ||
11:40 20mTalk | LEOPARD: Identifying Vulnerable Code for Vulnerability Assessment through Program MetricsTechnical Track Technical Track Xiaoning Du Nanyang Technological University, Bihuan Chen Fudan University, Yuekang Li Nanyang Technological University, Jianmin Guo Tsinghua University, Yaqin Zhou Nanyang Technological University, Yang Liu Nanyang Technological University, Singapore, Yu Jiang | ||
12:00 10mTalk | A Screening Test for Disclosed Vulnerabilities in FOSS ComponentsIndustry ProgramJournal-First Journal-First Papers Stanislav Dashevskyi University of Luxembourg, Achim D. Brucker The University of Sheffield, Fabio Massacci University of Trento Link to publication DOI Pre-print | ||
12:10 10mTalk | VULTRON: Catching Vulnerable Smart Contracts Once and for AllNIER New Ideas and Emerging Results Haijun Wang Nanyang Technological University, Yi Li Nanyang Technological University, Shang-Wei Lin Nanyang Technological University, Lei Ma Kyushu University, Yang Liu Nanyang Technological University, Singapore | ||
12:20 10mTalk | Discussion Period Papers | ||