Λεπτομέρειες βιβλιογραφικής εγγραφής
| Τίτλος: |
MadMax: Analyzing the Out-of-Gas World of Smart Contracts. |
| Συγγραφείς: |
Grech, Neville, Kong, Michael, Jurisevic, Anton, Brent, Lexi, Scholz, Bernhard, Smaragdakis, Yannis |
| Πηγή: |
Communications of the ACM; Oct2020, Vol. 63 Issue 10, p87-95, 9p, 7 Diagrams |
| Θεματικοί όροι: |
Electronic contracts, Computer security vulnerabilities, Computer crime prevention, Blockchains, Decompilers (Computer programs) |
| Περίληψη: |
Ethereum is a distributed blockchain platform, serving as an ecosystem for smart contracts: full-fledged intercommunicating programs that capture the transaction logic of an account. A gas limit caps the execution of an Ethereum smart contract: instructions, when executed, consume gas, and the execution proceeds as long as gas is available. Gas-focused vulnerabilities permit an attacker to force key contract functionality to run out of gas-effectively performing a permanent denial-of-service attack on the contract. Such vulnerabilities are among the hardest for programmers to protect against, as out-of-gas behavior may be uncommon in nonattack scenarios and reasoning about these vulnerabilities is nontrivial. In this paper, we identify gas-focused vulnerabilities and present MadMax: a static program analysis technique that automatically detects gas-focused vulnerabilities with very high confidence. MadMax combines a smart contract decompiler and semantic queries in Datalog. Our approach captures high-level program modeling concepts (such as "dynamic data structure storage" and "safely resumable loops") and delivers high precision and scalability. MadMax analyzes the entirety of smart contracts in the Ethereum blockchain in just 10 hours and flags vulnerabilities in contracts with a monetary value in billions of dollars. Manual inspection of a sample of flagged contracts shows that 81% of the sampled warnings do indeed lead to vulnerabilities. [ABSTRACT FROM AUTHOR] |
|
Copyright of Communications of the ACM is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) |
| Βάση Δεδομένων: |
Complementary Index |