Osiris

TLDR

Smart contracts on blockchains are immutable programs that execute business logic and hold billions of dollars, making their correctness critical as vulnerabilities have caused multi‑million dollar fraud. This study investigates integer‑related vulnerabilities in smart contracts, a hard‑to‑avoid class of bugs in Ethereum and Solidity. We analyze integer bugs in Ethereum smart contracts, examining how EVM and Solidity features make them difficult to avoid.

Abstract

The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed once deployed to the blockchain. They typically implement the business logic of distributed apps and carry billions of dollars worth of coins. In that respect, it is imperative that smart contracts are correct and have no vulnerabilities or bugs. However, research has identified different classes of vulnerabilities in smart contracts, some of which led to prominent multi-million dollar fraud cases. In this paper we focus on vulnerabilities related to integer bugs, a class of bugs that is particularly difficult to avoid due to some characteristics of the Ethereum Virtual Machine and the Solidity programming language.