Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Survey on Quality Assurance of Smart Contracts

Zhiyuan Wei, Jing Sun, Zijian Zhang, Xianhao Zhang, Xiaoxuan Yang, Liehuang Zhu

TL;DR

This survey targets the security of smart contracts by introducing a vulnerability taxonomy grounded in CWE, mapping 40 known vulnerabilities across Ethereum, Hyperledger Fabric, and EOSIO to 14 secondary causes, and linking these to eight representative real-world attacks. The authors review defense methodologies ranging from formal verification and symbolic execution to fuzzing and ML-based approaches, and evaluate 14 vulnerability-detection tools using a public 110-contract benchmark. They reveal a post-2021 shift toward ML and AI-assisted auditing, including large language models, while noting persistent gaps in unknown-attack detection and post-deployment repair. The work culminates in a public dataset and a multi-criteria evaluation framework to guide practitioners in choosing effective tools and methodologies for secure smart contract development and auditing.

Abstract

With the increasing adoption of smart contracts, ensuring their security has become a critical concern. Numerous vulnerabilities and attacks have been identified and exploited, resulting in significant financial losses. In response, researchers have developed various tools and techniques to identify and prevent vulnerabilities in smart contracts. In this survey, we present a systematic overview of the quality assurance of smart contracts, covering vulnerabilities, attacks, defenses, and tool support. By classifying vulnerabilities based on known attacks, we can identify patterns and common weaknesses that need to be addressed. Moreover, in order to effectively protect smart contracts, we have created a labeled dataset to evaluate various vulnerability detection tools and compare their effectiveness.

Survey on Quality Assurance of Smart Contracts

TL;DR

This survey targets the security of smart contracts by introducing a vulnerability taxonomy grounded in CWE, mapping 40 known vulnerabilities across Ethereum, Hyperledger Fabric, and EOSIO to 14 secondary causes, and linking these to eight representative real-world attacks. The authors review defense methodologies ranging from formal verification and symbolic execution to fuzzing and ML-based approaches, and evaluate 14 vulnerability-detection tools using a public 110-contract benchmark. They reveal a post-2021 shift toward ML and AI-assisted auditing, including large language models, while noting persistent gaps in unknown-attack detection and post-deployment repair. The work culminates in a public dataset and a multi-criteria evaluation framework to guide practitioners in choosing effective tools and methodologies for secure smart contract development and auditing.

Abstract

With the increasing adoption of smart contracts, ensuring their security has become a critical concern. Numerous vulnerabilities and attacks have been identified and exploited, resulting in significant financial losses. In response, researchers have developed various tools and techniques to identify and prevent vulnerabilities in smart contracts. In this survey, we present a systematic overview of the quality assurance of smart contracts, covering vulnerabilities, attacks, defenses, and tool support. By classifying vulnerabilities based on known attacks, we can identify patterns and common weaknesses that need to be addressed. Moreover, in order to effectively protect smart contracts, we have created a labeled dataset to evaluate various vulnerability detection tools and compare their effectiveness.
Paper Structure (64 sections, 1 equation, 10 figures, 7 tables)

This paper contains 64 sections, 1 equation, 10 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Overview of Smart Contracts and Survey Methodology
  3. Smart Contracts
  4. Survey Methodology
  5. Vulnerability in Smart Contracts
  6. Improper Adherence to Coding Standards
  7. Syntax Errors (VE1, VE2)
  8. Version Issues (VE3, VE4, VE5, VE6, VE7)
  9. Irrelevant Code (VE8, VE9, VE10)
  10. Visibility (VE11, VE12)
  11. Insufficient Verification of Data Authenticity
  12. Cryptographic Signatures (VE13, VE14, VE15)
  13. Cryptographic Data (VE16, VS1, VS2)
  14. Improper Access Control
  15. Unprotected Low-level Function (VE17, VE18, VE19)
  16. ...and 49 more sections

Figures (10)

  • Figure 1: Publications and Tools Over the Year
  • Figure 2: A classification of smart contracts vulnerabilities and their causes, where $\CIRCLE$ means the vulnerability has already been solved, $\Circle$ means the vulnerability is widely discussed (not solved), and $\LEFTcircle$ means the vulnerability has been fixed by specific approaches or tools. VE means vulnerabilities of Ethereum, VH means vulnerabilities of HF, VS means vulnerabilities of ESOIO.
  • Figure 3: Reentrancy attack flow
  • Figure 4: Vulnerabilities Frequency Statistics
  • Figure 5: Several high-profile attacks from 2016 to 2021
  • ...and 5 more figures