Panda: Security Analysis of Algorand Smart Contracts

Sun, Zhiyuan1,2; Luo, Xiapu1; Zhang, Yinqian2

2023

32nd USENIX Security Symposium

PROCEEDINGS OF THE 32ND USENIX SECURITY SYMPOSIUM

AUG 09-11, 2023

null,Anaheim,CA

SUITE 215, 2560 NINTH ST, BERKELEY, CA 94710 USA

USENIX ASSOC

Algorand has recently grown rapidly as a representative of the new generation of pure-proof-of-stake (PPoS) blockchains. At the same time, Algorand has also attracted more and more users to use it as a trading platform for non-fungible tokens. However, similar to traditional programs, the incorrect way of programming will lead to critical security vulnerabilities in Algorand smart contracts. In this paper, we first analyze the semantics of Algorand smart contracts and find 9 types of generic vulnerabilities. Next, we propose Panda, the first extensible static analysis framework that can automatically detect such vulnerabilities in Algorand smart contracts, and formally define the vulnerability detection rules. We also construct the first benchmark dataset to evaluate Panda. Finally, we used Panda to conduct a vulnerability assessment on all smart contracts on the Algorand blockchain and found 80,515 (10.38%) vulnerable smart signatures and 150,676 (27.73%) vulnerable applications. Of the vulnerable applications, 4,008 (4.04%) are still on the blockchain and have not been deleted. In the disclosure process, the vulnerabilities found by Panda have been acknowledged by many projects, including some critical blockchain infrastructures such as the decentralized exchange and the NFT auction platform.

通讯

英语

EI ; CPCI-S

Hong Kong RGC Projects["PolyU15219319","PolyU15224121"]

Computer Science

Computer Science, Information Systems ; Computer Science, Interdisciplinary Applications ; Computer Science, Theory & Methods

WOS:001066451501049

Web of Science

1.Hong Kong Polytechnic University, Hong Kong
2.Southern University of Science and Technology, China

Sun, Zhiyuan,Luo, Xiapu,Zhang, Yinqian. Panda: Security Analysis of Algorand Smart Contracts[C]. SUITE 215, 2560 NINTH ST, BERKELEY, CA 94710 USA:USENIX ASSOC,2023.