Smart contracts vulnerabilities: a call for blockchain software engineering?

TLDR

Smart contracts enable billions of dollars in daily transactions, yet since Ethereum’s Frontier launch numerous incidents have exposed the lack of a mature blockchain software engineering discipline and the difficulty of updating buggy contracts. This paper argues for a dedicated discipline of blockchain software engineering, illustrated by a case study of a Parity wallet bug that froze 500 k ethers. The authors examined the Parity source code and its library, showing how established best practices, if adapted, could have prevented the vulnerability. Their analysis demonstrates that unsafe smart‑contract programming can lead to large‑scale financial loss and that current best‑practice guidelines are insufficient without blockchain‑specific adaptations.

Abstract

Smart Contracts have gained tremendous popularity in the past few years, to the point that billions of US Dollars are currently exchanged every day through such technology. However, since the release of the Frontier network of Ethereum in 2015, there have been many cases in which the execution of Smart Contracts managing Ether coins has led to problems or conflicts. Compared to traditional Software Engineering, a discipline of Smart Contract and Blockchain programming, with standardized best practices that can help solve the mentioned problems and conflicts, is not yet sufficiently developed. Furthermore, Smart Contracts rely on a non-standard software life-cycle, according to which, for instance, delivered applications can hardly be updated or bugs resolved by releasing a new version of the software. In this paper we advocate the need for a discipline of Blockchain Software Engineering, addressing the issues posed by smart contract programming and other applications running on blockchains.We analyse a case of study where a bug discovered in a Smart Contract library, and perhaps "unsafe" programming, allowed an attack on Parity, a wallet application, causing the freezing of about 500K Ethers (about 150M USD, in November 2017). In this study we analyze the source code of Parity and the library, and discuss how recognised best practices could mitigate, if adopted and adapted, such detrimental software misbehavior. We also reflect on the specificity of Smart Contract software development, which makes some of the existing approaches insufficient, and call for the definition of a specific Blockchain Software Engineering.