Abstract:The blockchain technology, initially created for cryptocurrency, has been re-purposed for recording state transitions of smart contracts — decentralized applications that can be invoked through external transactions. Smart contracts gained popularity and accrued hundreds of billions of dollars in market capitalization in recent years. Unfortunately, like all other computer programs, smart contracts are prone to security vulnerabilities that have incurred multibillion-dollar damages over the past decade. As a result, many automated threat mitigation solutions have been proposed to counter the security issues of smart contracts. These threat mitigation solutions include various tools and methods that are challenging to compare. This survey develops a comprehensive classification taxonomy of smart contract threat mitigation solutions within five orthogonal dimensions: defense modality, core method, targeted contracts, input-output data mapping, and threat model. We classify 133 existing threat mitigation solutions using our taxonomy and confirm that the proposed five dimensions allow us to concisely and accurately describe any smart contract threat mitigation solution. In addition to learning what the threat mitigation solutions do, we also show how these solutions work by synthesizing their actual designs into a set of uniform workflows corresponding to the eight existing defense core methods. We further create an integrated coverage map for the known smart contract vulnerabilities by the existing threat mitigation solutions. Finally, we perform the evidence-based evolutionary analysis, in which we identify trends and future perspectives of threat mitigation in smart contracts and pinpoint major weaknesses of the existing methodologies. For the convenience of smart contract security developers, auditors, users, and researchers, we deploy and maintain a regularly updated comprehensive open-source online registry of threat mitigation solutions, called Security Threat Mitigation (STM) Registry at https://seit.egr.msu.edu/research/stmregistry/.

SolScope: Effectively Hunting Potential Permission Backdoor Threats in Smart Contracts.

Midas: Mining Profitable Exploits in On-Chain Smart Contracts Via Feedback-Driven Fuzzing and Differential Analysis

Smart Contract Vulnerability Detection Technique: A Survey

PrettySmart: Detecting Permission Re-delegation Vulnerability for Token Behaviors in Smart Contracts

EthScope: A Transaction-centric Security Analytics Framework to Detect Malicious Smart Contracts on Ethereum.

A Survey of Ethereum Smart Contract Security: Attacks and Detection

Security Defense for Smart Contracts: A Comprehensive Survey

Bug Searching in Smart Contract

Towards Safer Smart Contracts: A Sequence Learning Approach to Detecting Security Threats

Abusing the Ethereum Smart Contract Verification Services for Fun and Profit

Skyeye: Detecting Imminent Attacks Via Analyzing Adversarial Smart Contracts

Detecting Standard Violation Errors in Smart Contracts

Advanced Security Auditing Methods for Solidity-Based Smart Contracts

Pied-Piper: Revealing the Backdoor Threats in Ethereum ERC Token Contracts

Research on Security Vulnerability Detection of Smart Contract

Siguard: Detecting Signature-Related Vulnerabilities in Smart Contracts.

SmartState: Detecting State-Reverting Vulnerabilities in Smart Contracts via Fine-Grained State-Dependency Analysis

Smart Contract Vulnerability Detection based on Static Analysis and Multi-Objective Search

Security Threat Mitigation For Smart Contracts: A Comprehensive Survey

A Survey of Smart Contract Vulnerability Research

SVScanner: Detecting Smart Contract Vulnerabilities Via Deep Semantic Extraction