Smart Contract Repair

Xiao Liang Yu,Omar Al-Bataineh,David Lo,Abhik Roychoudhury

DOI: https://doi.org/10.48550/arXiv.1912.05823

2020-05-20

Abstract:Smart contracts are automated or self-enforcing contracts that can be used to exchange assets without having to place trust in third parties. Many commercial transactions use smart contracts due to their potential benefits in terms of secure peer-to-peer transactions independent of external parties. Experience shows that many commonly used smart contracts are vulnerable to serious malicious attacks which may enable attackers to steal valuable assets of involving parties. There is therefore a need to apply analysis and automated repair techniques to detect and repair bugs in smart contracts before being deployed. In this work, we present the first general-purpose automated smart contract repair approach that is also gas-aware. Our repair method is search-based and searches among mutations of the buggy contract. Our method also considers the gas usage of the candidate patches by leveraging our novel notion of gas dominance relationship. We have made our smart contract repair tool SCRepair available open-source, for investigation by the wider community.

Software Engineering,Cryptography and Security,Programming Languages

What problem does this paper attempt to address?

The problem this paper attempts to address is the automatic repair of vulnerabilities in smart contracts. Specifically, smart contracts are automated or self-executing contracts that can be used to exchange assets without the need for a trusted third party. However, many commonly used smart contracts are susceptible to malicious attacks, which can lead to attackers stealing valuable assets from the involved parties. Therefore, it is necessary to apply analysis and automated repair techniques to detect and fix vulnerabilities in smart contracts to ensure their security before deployment.

The main contributions of the paper include:
1. Proposing a new general automated smart contract repair method that not only fixes vulnerabilities but also optimizes the contract's Gas consumption.
2. Describing a parallel genetic repair algorithm that can divide the large candidate patch search space into smaller mutually exclusive subspaces and handle these subspaces independently, thereby speeding up the patch generation process.
3. Introducing the concept of Gas Dominance Level to compare the runtime Gas consumption of different patches, ensuring that the generated patches are optimized in terms of Gas consumption.
4. Developing a fully automated smart contract repair tool (SCRepair) that integrates the Gas ranking method to generate optimized and secure contracts. This tool can not only detect security vulnerabilities in smart contracts but also fix these vulnerabilities.

Through these contributions, the paper aims to improve the reliability and security of smart contracts, reducing financial losses and other adverse consequences caused by vulnerabilities.