Characterizing Transaction-Reverting Statements in Ethereum Smart Contracts

Lu Liu1,2; Lili Wei2; Wuqi Zhang2; Ming Wen3; Yepang Liu1; Shing-Chi Cheung2

10.1109/ASE51524.2021.9678597

2021

The 36th IEEE/ACM International Conference on Automated Software Engineering

1938-4300

978-1-6654-4784-3

2021 36TH IEEE/ACM INTERNATIONAL CONFERENCE ON AUTOMATED SOFTWARE ENGINEERING ASE 2021

630-641

14-20 November 2021

Australia

345 E 47TH ST, NEW YORK, NY 10017 USA

IEEE

Smart contracts are programs stored on blockchains to execute transactions. When input constraints or security properties are violated at runtime, the transaction being executed by a smart contract needs to be reverted to avoid undesirable consequences. On Ethereum, the most popular blockchain that supports smart contracts, developers can choose among three transaction-reverting statements (i.e., require, if ... revert, and if ... throw) to handle anomalous transactions. While these transaction-reverting statements are vital for preventing smart contracts from exhibiting abnormal behaviors or suffering malicious attacks, there is limited understanding of how they are used in practice. In this work, we perform the first empirical study to characterize transaction-reverting statements in Ethereum smart contracts. We measured the prevalence of these statements in 3,866 verified smart contracts from popular dapps and built a taxonomy of their purposes via manually analyzing 557 transaction-reverting statements. We also compared template contracts and their corresponding custom contracts to understand how developers customize the use of transaction-reverting statements. Finally, we analyzed the security impact of transaction-reverting statements by removing them from smart contracts and comparing the mutated contracts against the original ones. Our study led to important findings. For example, we found that transaction-reverting statements are commonly used to perform seven types of authority verifications or validity checks, and missing such statements may compromise the security of smart contracts. We also found that current smart contract security analyzers cannot effectively handle transaction-reverting statements when detecting security vulnerabilities. Our findings can shed light on further research in the broad area of smart contract quality assurance and provide practical guidance to smart contract developers on the appropriate use of transaction-reverting statements.

Ethereum smart contract transaction-reverting statement empirical study security vulnerability

第一 ; 通讯

英语

CPCI-S ; EI

National Natural Science Foundation of China[61932021,62002125]

Computer Science

Computer Science, Software Engineering

WOS:000779309000054

20220911734448

Ethereum ; Network security ; Quality assurance

Computer Software, Data Handling and Applications:723 ; Legal Aspects:902.3 ; Quality Assurance and Control:913.3

人工提交

1.Southern University of Science and Technology
2.The Hong Kong University of Science and Technology
3.Huazhong University of Science and Technology

Lu Liu,Lili Wei,Wuqi Zhang,et al. Characterizing Transaction-Reverting Statements in Ethereum Smart Contracts[C]. 345 E 47TH ST, NEW YORK, NY 10017 USA:IEEE,2021:630-641.