Empirical Review of Smart Contract and DeFi Security: Vulnerability Detection and Automated Repair

Peng Qian,Rui Cao,Zhenguang Liu,Wenqing Li,Ming Li,Lun Zhang,Yufeng Xu,Jianhai Chen,Qinming He
DOI: https://doi.org/10.48550/arXiv.2309.02391
2023-09-07
Abstract:Decentralized Finance (DeFi) is emerging as a peer-to-peer financial ecosystem, enabling participants to trade products on a permissionless blockchain. Built on blockchain and smart contracts, the DeFi ecosystem has experienced explosive growth in recent years. Unfortunately, smart contracts hold a massive amount of value, making them an attractive target for attacks. So far, attacks against smart contracts and DeFi protocols have resulted in billions of dollars in financial losses, severely threatening the security of the entire DeFi ecosystem. Researchers have proposed various security tools for smart contracts and DeFi protocols as countermeasures. However, a comprehensive investigation of these efforts is still lacking, leaving a crucial gap in our understanding of how to enhance the security posture of the smart contract and DeFi landscape. To fill the gap, this paper reviews the progress made in the field of smart contract and DeFi security from the perspective of both vulnerability detection and automated repair. First, we analyze the DeFi smart contract security issues and challenges. Specifically, we lucubrate various DeFi attack incidents and summarize the attacks into six categories. Then, we present an empirical study of 42 state-of-the-art techniques that can detect smart contract and DeFi vulnerabilities. In particular, we evaluate the effectiveness of traditional smart contract bug detection tools in analyzing complex DeFi protocols. Additionally, we investigate 8 existing automated repair tools for smart contracts and DeFi protocols, providing insight into their advantages and disadvantages. To make this work useful for as wide of an audience as possible, we also identify several open issues and challenges in the DeFi ecosystem that should be addressed in the future.
Cryptography and Security,Software Engineering
What problem does this paper attempt to address?
The problems that this paper attempts to solve mainly focus on the security of the decentralized finance (DeFi) ecosystem. Specifically, the paper aims to: 1. **Understand DeFi attacks**: Although DeFi is constantly evolving, its ecosystem still has a large number of security vulnerabilities, resulting in frequent attack incidents. These attacks have not only caused huge economic losses but also seriously hindered the development of DeFi. By analyzing 57 reported DeFi attack incidents in the past three years, the paper summarizes six common types of DeFi attacks and provides specific attack case analyses. These six types of attacks include: - Flash loan attacks (arbitrage, price manipulation, re - entry attacks) - Deflationary token attacks - Compound attacks - Rug - pull attacks 2. **Evaluate existing smart contracts and DeFi security tools**: The paper conducts a systematic evaluation of existing smart contracts and DeFi security tools, especially for vulnerability detection and automated repair tools. Specifically: - The paper investigates 42 state - of - the - art vulnerability detection techniques and evaluates the effectiveness of these traditional smart contract vulnerability detection tools in analyzing complex DeFi protocols. - The paper also studies 8 existing automated repair tools and explores their strengths and weaknesses. 3. **Identify and address open issues and challenges in the DeFi ecosystem**: The paper not only summarizes existing research results but also points out the open issues and challenges in the DeFi ecosystem that require further research, providing directions for future research. Through the above three aspects of research, the paper hopes to provide the DeFi community with a comprehensive security assessment and improvement plan, thereby enhancing the overall security of the DeFi ecosystem.