Abstract:The blockchain technology, initially created for cryptocurrency, has been re-purposed for recording state transitions of smart contracts — decentralized applications that can be invoked through external transactions. Smart contracts gained popularity and accrued hundreds of billions of dollars in market capitalization in recent years. Unfortunately, like all other computer programs, smart contracts are prone to security vulnerabilities that have incurred multibillion-dollar damages over the past decade. As a result, many automated threat mitigation solutions have been proposed to counter the security issues of smart contracts. These threat mitigation solutions include various tools and methods that are challenging to compare. This survey develops a comprehensive classification taxonomy of smart contract threat mitigation solutions within five orthogonal dimensions: defense modality, core method, targeted contracts, input-output data mapping, and threat model. We classify 133 existing threat mitigation solutions using our taxonomy and confirm that the proposed five dimensions allow us to concisely and accurately describe any smart contract threat mitigation solution. In addition to learning what the threat mitigation solutions do, we also show how these solutions work by synthesizing their actual designs into a set of uniform workflows corresponding to the eight existing defense core methods. We further create an integrated coverage map for the known smart contract vulnerabilities by the existing threat mitigation solutions. Finally, we perform the evidence-based evolutionary analysis, in which we identify trends and future perspectives of threat mitigation in smart contracts and pinpoint major weaknesses of the existing methodologies. For the convenience of smart contract security developers, auditors, users, and researchers, we deploy and maintain a regularly updated comprehensive open-source online registry of threat mitigation solutions, called Security Threat Mitigation (STM) Registry at https://seit.egr.msu.edu/research/stmregistry/.

Smart contract: a survey towards extortionate vulnerability detection and security enhancement

Smart Contract Vulnerability Detection Technique: A Survey

Smart Contract Security: A Practitioners' Perspective: The Artifact of a Paper Accepted in the 43rd IEEE/ACM International Conference on Software Engineering (ICSE 2021)

A Survey of Smart Contract Vulnerability Research

A survey on smart contract vulnerabilities: Data sources, detection and repair

A Survey of Ethereum Smart Contract Security: Attacks and Detection

Vulnerability Analysis of Smart Contracts

Smart Contract Vulnerabilities, Tools, and Benchmarks: An Updated Systematic Literature Review

A Survey of Security Vulnerabilities in Ethereum Smart Contracts

Empirical Vulnerability Analysis of Automated Smart Contracts Security Testing on Blockchains

Smart Contract Security Vulnerabilities

Investigating Security Vulnerabilities and Tools of Blockchain Smart Contract: A Review

Detection of Vulnerabilities in Blockchain Smart Contracts: A Review

Vulnerabilities of smart contracts and mitigation schemes: A Comprehensive Survey

Security Defense for Smart Contracts: A Comprehensive Survey

Systematic Review of Security Vulnerabilities in Ethereum Blockchain Smart Contract

Exploring Security Practices of Smart Contract Developers

Making Smart Contracts Smarter

A Survey on Vulnerabilities of Ethereum Smart Contracts

Security Threat Mitigation For Smart Contracts: A Comprehensive Survey

A Systematic Literature Review on Smart Contracts Security