Chaliasos, S;
Galanopoulou, R;
Charalambous, MA;
Gervais, A;
Livshits, B;
Zhou, L;
Mitropoulos, D;
(2024)
Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners?
In:
Proceedings of the 46th IEEE/ACM International Conference on Software Engineering.
(pp. pp. 1-13).
ACM (Association for Computing Machinery)
Preview |
PDF
3597503.3623302.pdf - Published Version Download (739kB) | Preview |
Abstract
The growth of the decentralized finance (DeFi) ecosystem built on blockchain technology and smart contracts has led to an increased demand for secure and reliable smart contract development. However, attacks targeting smart contracts are increasing, causing an estimated $6.45 billion in financial losses. Researchers have proposed various automated security tools to detect vulnerabilities, but their real-world impact remains uncertain. In this paper, we aim to shed light on the effectiveness of automated security tools in identifying vulnerabilities that can lead to high-profile attacks, and their overall usage within the industry. Our comprehensive study encompasses an evaluation of five SoTA automated security tools, an analysis of 127 high-impact real-world attacks resulting in $2.3 billion in losses, and a survey of 49 developers and auditors working in leading DeFi protocols. Our findings reveal a stark reality: the tools could have prevented a mere 8% of the attacks in our dataset, amounting to $149 million out of the $2.3 billion in losses. Notably, all preventable attacks were related to reentrancy vulnerabilities. Furthermore, practitioners distinguish logic-related bugs and protocol layer vulnerabilities as significant threats that are not adequately addressed by existing security tools. Our results emphasize the need to develop specialized tools catering to the distinct demands and expectations of developers and auditors. Further, our study highlights the necessity for continuous advancements in security tools to effectively tackle the ever-evolving challenges confronting the DeFi ecosystem.
| Type: | Proceedings paper |
|---|---|
| Title: | Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners? |
| Event: | ICSE '24: 46th IEEE/ACM International Conference on Software Engineering |
| ISBN-13: | 9798400702174 |
| Open access status: | An open access version is available from UCL Discovery |
| DOI: | 10.1145/3597503.3623302 |
| Publisher version: | http://dx.doi.org/10.1145/3597503.3623302 |
| Language: | English |
| Additional information: | © 2024 Copyright held by the owner/author(s). Original content in this paper is licensed under the terms of the Creative Commons Attribution 4.0 International (CC BY 4.0) Licence (https://creativecommons.org/licenses/by/4.0/). |
| UCL classification: | UCL UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
| URI: | https://discovery.ucl.ac.uk/id/eprint/10188397 |
Archive Staff Only
 |
View Item |
