亲爱的研友该休息了!由于当前在线用户较少,发布求助请尽量完整地填写文献信息,科研通机器人24小时在线,伴您度过漫漫科研夜!身体可是革命的本钱,早点休息,好梦!

Revealing Hidden Threats: An Empirical Study of Library Misuse in Smart Contracts

计算机科学 坚固性 审计 万维网 智能合约 计算机安全 业务 会计 块链 程序设计语言
作者
Mingyuan Huang,Jiachi Chen,Zigui Jiang,Zibin Zheng
标识
DOI:10.1145/3597503.3623335
摘要

Smart contracts are Turing-complete programs that execute on the blockchain. Developers can implement complex contracts, such as auctions and lending, on Ethereum using the Solidity programming language. As an object-oriented language, Solidity provides libraries within its syntax to facilitate code reusability and reduce development complexity. Library misuse refers to the incorrect writing or usage of libraries, resulting in unexpected results, such as introducing vulnerabilities during library development or incorporating an unsafe library during contract development. Library misuse could lead to contract defects that cause financial losses. Currently, there is a lack of research on library misuse. To fill this gap, we collected more than 500 audit reports from the official websites of five audit companies and 223,336 real-world smart contracts from Etherscan to measure library popularity and library misuse. Then, we defined eight general patterns for library misuse; three of them occurring during library development and five during library utilization, which covers the entire library lifecycle. To validate the practicality of these patterns, we manually analyzed 1,018 real-world smart contracts and publicized our dataset. We identified 905 misuse cases across 456 contracts, indicating that library misuse is a widespread issue. Three patterns of misuse are found in more than 50 contracts, primarily due to developers lacking security awareness or underestimating negative impacts. Additionally, our research revealed that vulnerable libraries on Ethereum continue to be employed even after they have been deprecated or patched. Our findings can assist contract developers in preventing library misuse and ensuring the safe use of libraries.
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
轻松的惜芹应助linkman采纳,获得10
刚刚
慕青应助我爱物理采纳,获得10
3秒前
3秒前
充电宝应助霜鸣采纳,获得10
5秒前
6秒前
隐形曼青应助伽拉采纳,获得10
7秒前
hhw完成签到,获得积分10
7秒前
咕噜噜发布了新的文献求助10
9秒前
12秒前
13秒前
研友_qZ6V1Z发布了新的文献求助10
14秒前
涨秋池发布了新的文献求助10
15秒前
燕子完成签到 ,获得积分10
15秒前
15秒前
nicenice发布了新的文献求助10
17秒前
17秒前
yx_cheng应助linkman采纳,获得10
20秒前
21秒前
Bowman发布了新的文献求助30
21秒前
Anthonywll完成签到 ,获得积分10
30秒前
壮观的海豚完成签到 ,获得积分10
33秒前
慕青应助喂喂采纳,获得10
34秒前
zx完成签到 ,获得积分10
36秒前
guozao发布了新的文献求助10
38秒前
咖啡龙完成签到,获得积分20
38秒前
yx_cheng应助linkman采纳,获得10
40秒前
43秒前
ET完成签到,获得积分10
44秒前
完美世界应助towerman采纳,获得10
50秒前
hi_traffic完成签到,获得积分10
55秒前
55秒前
HXY完成签到,获得积分10
57秒前
58秒前
58秒前
1分钟前
领导范儿应助linkman采纳,获得30
1分钟前
eric888应助guozao采纳,获得150
1分钟前
1分钟前
小马甲应助科研通管家采纳,获得10
1分钟前
towerman完成签到,获得积分10
1分钟前
高分求助中
The Mother of All Tableaux: Order, Equivalence, and Geometry in the Large-scale Structure of Optimality Theory 3000
A new approach to the extrapolation of accelerated life test data 1000
ACSM’s Guidelines for Exercise Testing and Prescription, 12th edition 500
Indomethacinのヒトにおける経皮吸収 400
Phylogenetic study of the order Polydesmida (Myriapoda: Diplopoda) 370
基于可调谐半导体激光吸收光谱技术泄漏气体检测系统的研究 350
Robot-supported joining of reinforcement textiles with one-sided sewing heads 320
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 3990012
求助须知:如何正确求助?哪些是违规求助? 3532049
关于积分的说明 11256153
捐赠科研通 3270925
什么是DOI,文献DOI怎么找? 1805123
邀请新用户注册赠送积分活动 882270
科研通“疑难数据库(出版商)”最低求助积分说明 809216