Demystifying Invariant Effectiveness for Securing Smart Contracts

Zhiyang Chen,Ye Liu,Sidi Mohamed Beillahi,Yi Li,Fan Long

DOI: https://doi.org/10.1145/366078

2024-07-14

Abstract:Smart contract transactions associated with security attacks often exhibit distinct behavioral patterns compared with historical benign transactions before the attacking events. While many runtime monitoring and guarding mechanisms have been proposed to validate invariants and stop anomalous transactions on the fly, the empirical effectiveness of the invariants used remains largely unexplored. In this paper, we studied 23 prevalent invariants of 8 categories, which are either deployed in high-profile protocols or endorsed by leading auditing firms and security experts. Using these well-established invariants as templates, we developed a tool Trace2Inv which dynamically generates new invariants customized for a given contract based on its historical transaction data. We evaluated Trace2Inv on 42 smart contracts that fell victim to 27 distinct exploits on the Ethereum blockchain. Our findings reveal that the most effective invariant guard alone can successfully block 18 of the 27 identified exploits with minimal gas overhead. Our analysis also shows that most of the invariants remain effective even when the experienced attackers attempt to bypass them. Additionally, we studied the possibility of combining multiple invariant guards, resulting in blocking up to 23 of the 27 benchmark exploits and achieving false positive rates as low as 0.32%. Trace2Inv outperforms current state-of-the-art works on smart contract invariant mining and transaction attack detection in terms of both practicality and accuracy. Though Trace2Inv is not primarily designed for transaction attack detection, it surprisingly found two previously unreported exploit transactions, earlier than any reported exploit transactions against the same victim contracts.

Cryptography and Security,Programming Languages,Software Engineering

What problem does this paper attempt to address?

The problem that this paper attempts to solve is how to enhance the security of smart contracts through the effectiveness of runtime invariants when facing security attacks. Specifically, the authors focus on:

1. **Abnormal behavior detection**: Smart contract transactions usually exhibit different behavior patterns from historical benign transactions before and after being attacked. Many existing runtime monitoring and protection mechanisms have been proposed to verify these invariants and block abnormal transactions in real - time, but the actual effectiveness of these invariants has not been fully studied.

2. **Empirical evaluation of invariants**: The paper conducts an empirical analysis of 23 commonly - used invariants (divided into 8 categories). These invariants are either already deployed in well - known protocols or recommended by leading audit companies and security experts. The research aims to evaluate the performance of these invariants in actual attack scenarios.

3. **Automatically generating invariants**: In order to dynamically generate new, customized invariants, the authors develop a tool named Trace2Inv. This tool automatically generates new invariants suitable for specific contracts based on the historical transaction data of a given contract.

4. **Effect of combined invariants**: The research also explores the effect of using multiple invariants in combination, in order to improve the ability to prevent malicious attacks and reduce the false positive rate.

### Main contributions of the paper

- **Invariant reasoning**: Conducted extensive research on 23 invariant templates and proposed new techniques for effectively inferring invariants from transaction history.
- **Trace2Inv tool**: Designed and implemented Trace2Inv, a tool specifically for smart contract transaction analysis and invariant inference.
- **Experimental results**: For the first time, systematically and quantitatively evaluated the effectiveness of runtime invariants on 42 smart contracts that have been attacked, covering 27 real - world attack cases.
- **Key findings**: Revealed a series of key insights regarding the application and development of dynamic invariants.

### Research questions

The paper mainly explores the following research questions:

- **RQ1**: Given that attack transactions often exhibit abnormal behavior, which types of invariant guards are most effective in blocking attack transactions?
- **RQ2**: If attack transactions or benign transactions violate invariant guards, how difficult is it for attackers or ordinary users to bypass them?
- **R- Q3**: Since attack transactions may involve abnormalities in multiple dimensions, what is the effect of combinations of different invariant guards in preventing attacks?
- **RQ4**: Invariant guards require additional gas fees at runtime. What are the gas costs of different types of invariant guards?
- **RQ5**: In terms of enhancing the security of smart contracts, how does this work compare with other state - of - the - art contract invariant generation or transaction - anomaly - detection methods?

Through the answers to these questions, the paper provides important theoretical and technical support for improving the security of smart contracts.