Ethereum Smart Contracts: Security Vulnerabilities and Security Tools

Ethereum represents the second generation of blockchain technology by providing an open and global computing platform which allows the exchange of cryptocurrency (Ether) and the development of self-verifying smart contract applications. Smart contracts present a foundation for possessing digital assets and a variety of decentralized applications within the blockchain area. Ethereum and smart contracts are public, distributed and immutable, as such, they are prone to vulnerabilities sourcing from simple coding mistakes of developers. Motivated by the security breaches and recurring financial losses in smart contracts, we aim to advance the field of security in smart contract programming. The main objective is to aid smart contract developers by providing a taxonomy of all known security issues and by inspecting the security code analysis tools used to identify those vulnerabilities. Based on previous research as well as attacks on Ethereum smart contracts, we propose an updated taxonomy which categorizes all known vulnerabilities within their architectural and severity level. Our second proposed taxonomy is a novel categorization of security tools on Ethereum. Furthermore, we conduct the investigation of security code analysis tools on Ethereum by assessing their effectiveness and accuracy. In particular, we analyze four security tools, namely, Oyente, Securify, Remix, and SmartCheck. The results indicate that there are overall inconsistencies between the tools on different security properties. SmartCheck outperformed the other tools in terms of effectiveness, whereas Oyente performed the best in terms of accuracy. Furthermore, based on the limitations we identified, we propose future improvements within the user interfaces, interpretation of results, and additional vulnerability checks.