Revealing Hidden Threats: An Empirical Study of Library Misuse in Smart Contracts

计算机科学 坚固性 审计 万维网 智能合约 计算机安全 业务 会计 块链 程序设计语言
作者
Mingyuan Huang,Jiachi Chen,Zigui Jiang,Zibin Zheng
标识
DOI:10.1145/3597503.3623335
摘要

Smart contracts are Turing-complete programs that execute on the blockchain. Developers can implement complex contracts, such as auctions and lending, on Ethereum using the Solidity programming language. As an object-oriented language, Solidity provides libraries within its syntax to facilitate code reusability and reduce development complexity. Library misuse refers to the incorrect writing or usage of libraries, resulting in unexpected results, such as introducing vulnerabilities during library development or incorporating an unsafe library during contract development. Library misuse could lead to contract defects that cause financial losses. Currently, there is a lack of research on library misuse. To fill this gap, we collected more than 500 audit reports from the official websites of five audit companies and 223,336 real-world smart contracts from Etherscan to measure library popularity and library misuse. Then, we defined eight general patterns for library misuse; three of them occurring during library development and five during library utilization, which covers the entire library lifecycle. To validate the practicality of these patterns, we manually analyzed 1,018 real-world smart contracts and publicized our dataset. We identified 905 misuse cases across 456 contracts, indicating that library misuse is a widespread issue. Three patterns of misuse are found in more than 50 contracts, primarily due to developers lacking security awareness or underestimating negative impacts. Additionally, our research revealed that vulnerable libraries on Ethereum continue to be employed even after they have been deprecated or patched. Our findings can assist contract developers in preventing library misuse and ensuring the safe use of libraries.
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
故意的靳完成签到,获得积分10
1秒前
mzhmhy完成签到,获得积分10
1秒前
bkagyin应助wish采纳,获得10
5秒前
Afaq发布了新的文献求助10
5秒前
果粒多发布了新的文献求助10
6秒前
6秒前
无辜如容完成签到,获得积分10
7秒前
7秒前
10秒前
11秒前
ASA发布了新的文献求助30
11秒前
12秒前
情怀应助tingting9采纳,获得10
13秒前
FXQ123_范发布了新的文献求助10
13秒前
sun完成签到,获得积分20
13秒前
15秒前
彭于晏应助wldsd采纳,获得30
15秒前
量子星尘发布了新的文献求助10
15秒前
16秒前
16秒前
高一淼发布了新的文献求助10
17秒前
明道若昧完成签到,获得积分10
17秒前
上官若男应助mk采纳,获得10
18秒前
wish完成签到,获得积分10
20秒前
wish发布了新的文献求助10
22秒前
稍等一下完成签到 ,获得积分10
23秒前
momo发布了新的文献求助10
23秒前
25秒前
25秒前
liang白开完成签到,获得积分10
27秒前
mk发布了新的文献求助10
29秒前
丘比特应助嗯嗯采纳,获得10
29秒前
乐乐应助abin采纳,获得10
31秒前
史念薇发布了新的文献求助10
31秒前
31秒前
Hello应助Afaq采纳,获得10
34秒前
Tourist完成签到 ,获得积分10
36秒前
王路飞发布了新的文献求助10
36秒前
39秒前
40秒前
高分求助中
A new approach to the extrapolation of accelerated life test data 1000
ACSM’s Guidelines for Exercise Testing and Prescription, 12th edition 500
‘Unruly’ Children: Historical Fieldnotes and Learning Morality in a Taiwan Village (New Departures in Anthropology) 400
Indomethacinのヒトにおける経皮吸収 400
Phylogenetic study of the order Polydesmida (Myriapoda: Diplopoda) 370
基于可调谐半导体激光吸收光谱技术泄漏气体检测系统的研究 350
Robot-supported joining of reinforcement textiles with one-sided sewing heads 320
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 3989263
求助须知:如何正确求助?哪些是违规求助? 3531418
关于积分的说明 11253814
捐赠科研通 3270066
什么是DOI,文献DOI怎么找? 1804884
邀请新用户注册赠送积分活动 882084
科研通“疑难数据库(出版商)”最低求助积分说明 809136