Abstract:Decentralized Finance (DeFi) is emerging as a peer-to-peer financial ecosystem, enabling participants to trade products on a permissionless blockchain. Built on blockchain and smart contracts, the DeFi ecosystem has experienced explosive growth in recent years. Unfortunately, smart contracts hold a massive amount of value, making them an attractive target for attacks. So far, attacks against smart contracts and DeFi protocols have resulted in billions of dollars in financial losses, severely threatening the security of the entire DeFi ecosystem. Researchers have proposed various security tools for smart contracts and DeFi protocols as countermeasures. However, a comprehensive investigation of these efforts is still lacking, leaving a crucial gap in our understanding of how to enhance the security posture of the smart contract and DeFi landscape. To fill the gap, this paper reviews the progress made in the field of smart contract and DeFi security from the perspective of both vulnerability detection and automated repair. First, we analyze the DeFi smart contract security issues and challenges. Specifically, we lucubrate various DeFi attack incidents and summarize the attacks into six categories. Then, we present an empirical study of 42 state-of-the-art techniques that can detect smart contract and DeFi vulnerabilities. In particular, we evaluate the effectiveness of traditional smart contract bug detection tools in analyzing complex DeFi protocols. Additionally, we investigate 8 existing automated repair tools for smart contracts and DeFi protocols, providing insight into their advantages and disadvantages. To make this work useful for as wide of an audience as possible, we also identify several open issues and challenges in the DeFi ecosystem that should be addressed in the future.

Towards Automated Security Analysis of Smart Contracts Based on Execution Property Graph

Smart Contract Vulnerability Detection Technique: A Survey

Toward Vulnerability Detection for Ethereum Smart Contracts Using Graph-Matching Network

An Ever-evolving Game: Evaluation of Real-world Attacks and Defenses in Ethereum Ecosystem.

An efficient approach to secure smart contract of Ethereum blockchain using hybrid security analysis approach

Mathematical Analysis of Existing Techniques for Ethereum Smart Contract Vulnerability Detection

A security framework for Ethereum smart contracts

A Smart Contract Vulnerability Detection Method Based on Program Dependency Graph

EVM-Shield: In-Contract State Access Control for Fast Vulnerability Detection and Prevention

Security Analysis of DeFi: Vulnerabilities, Attacks and Advances

Dual-view Aware Smart Contract Vulnerability Detection for Ethereum

A Survey of Ethereum Smart Contract Security: Attacks and Detection

EtherGIS: A Vulnerability Detection Framework for Ethereum Smart Contracts Based on Graph Learning Features

Smart Contract Vulnerability Detection based on Static Analysis and Multi-Objective Search

EOSAFE: Security Analysis of EOSIO Smart Contracts

Advanced Security Auditing Methods for Solidity-Based Smart Contracts

An Efficient Smart Contract Vulnerability Detector Based on Semantic Contract Graphs Using Approximate Graph Matching

Versioned Analysis of Software Quality Indicators and Self-admitted Technical Debt in Ethereum Smart Contracts with Ethstractor

SmartBugs 2.0: An Execution Framework for Weakness Detection in Ethereum Smart Contracts

Empirical Review of Smart Contract and DeFi Security: Vulnerability Detection and Automated Repair

SmartFast: an accurate and robust formal analysis tool for Ethereum smart contracts