Copy-and-Paste? Identifying EVM-Inequivalent Code Smells in Multi-chain Reuse Contracts

TL;DR

The paper addresses the risk of inconsistent contract execution when Ethereum contracts are reused on diverse EVM-compatible blockchains. It introduces EVM-Inequivalent Code Smells and presents EquivGuard, a detector that combines static taint analysis with symbolic execution to identify six smells across 905,948 contracts on six blockchains, achieving 95.29% precision and 99.06% recall. The study defines the smells via empirical analysis of 1,379 security audit reports and 326 Stack Overflow posts, and provides a large real-world dataset (17.70% prevalence) to underscore the security implications of copy-and-paste contract reuse. The work offers practical guidance for auditors and developers, demonstrates a cross-chain attack case, and delivers a publicly available tool and data to improve secure multi-chain contract reuse.

Abstract

As the development of Solidity contracts on Ethereum, more developers are reusing them on other compatible blockchains. However, developers may overlook the differences between the designs of the blockchain system, such as the Gas Mechanism and Consensus Protocol, leading to the same contracts on different blockchains not being able to achieve consistent execution as on Ethereum. This inconsistency reveals design flaws in reused contracts, exposing code smells that hinder code reusability, and we define this inconsistency as EVM-Inequivalent Code Smells. In this paper, we conducted the first empirical study to reveal the causes and characteristics of EVM-Inequivalent Code Smells. To ensure the identified smells reflect real developer concerns, we collected and analyzed 1,379 security audit reports and 326 Stack Overflow posts related to reused contracts on EVM-compatible blockchains, such as Binance Smart Chain (BSC) and Polygon. Using the open card sorting method, we defined six types of EVM-Inequivalent Code Smells. For automated detection, we developed a tool named EquivGuard. It employs static taint analysis to identify key paths from different patterns and uses symbolic execution to verify path reachability. Our analysis of 905,948 contracts across six major blockchains shows that EVM-Inequivalent Code Smells are widespread, with an average prevalence of 17.70%. While contracts with code smells do not necessarily lead to financial loss and attacks, their high prevalence and significant asset management underscore the potential threats of reusing these smelly Ethereum contracts. Thus, developers are advised to abandon Copy-and-Paste programming practices and detect EVM-Inequivalent Code Smells before reusing Ethereum contracts.

Figures (12)

• Figure 1: An example of the Stack Overflow Post (SOP).
• Figure 2: An example of the Security Audit Report (SAR).
• Figure 3: The example of Cross-Chain Replay Attack (CCRA)
• Figure 4: The example of Time Discrepancy Trap (TDT)
• Figure 5: The example of Phishing Contract Address (PCA)