이더리움 스마트 계약 프로그램의 ERC-20 API 기능 명세의관례상 표준과 적합성 리뷰 방법
A De Facto Standard for ERC-20 API Functional Specifications and Its Conformance Review Method for Ethereum Smart Contracts
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
이더리움 토큰 스마트 계약의 표준 API인 ERC-20은 지갑이나 분산 거래소같은 응용 프로그램들에서 호환성을 보장하기 위해 도입되었다. 그러나API의 동작에 대한 엄밀한 기능 명세와 표준 적합성 리뷰 도구는 지원되고 있지 않아 호환성 취약점 문제가 발생할 수 있다. 본 논문에서는 이더리움블록체인의 ERC-20 토큰 스마트 계약 프로그램들의 관례상 표준에 부합하는지 검사하는 새로운 리뷰 절차와 이를 지원하는 도구를 제안하였다. 기존 이더리움 블록체인 시장 상위 100개의 토큰 스마트 계약 프로그램들을 ERC-20 API 기능 동작면에서 분석한 지식을 바탕으로 관례상 표준을명시적으로 정의하였고, 이렇게 정의된 관례상 표준으로 새로운 ERC-20 스마트 계약 프로그램을 체계적으로 리뷰할 수 있는 방법을 설계할 수있었다. 이 리뷰 방법을 지원하는 도구를 개발하고 벤치마크 프로그램에 대해 실험 평가하였다.
Abstract
ERC-20, the standard API for Ethereum token smart contracts, was introduced to ensure compatibility among applications such aswallets and decentralized exchanges. However, many compatibility vulnerability problems have existed because there is no rigorousfunctional specifications for each API nor conformance review tools for the standard. In this paper, we proposed a new review procedureand a tool to perform the procedure to review if ERC-20 token smart contract programs for the Ethereum blockchain conform to thede facto standards. Based on the knowledge from an analysis on the ERC-20 API functional behavior of the top 100 token smart contractprograms in the existing Ethereum blockchain, a new specification for the de facto standard for ERC-20 API was explicitly defined. Thenew specification enabled us to design a systematic review method for Ethereum smart contract programs. We developed a tool to supportthis review method and we evaluated a few benchmark programs with the tool.
참고문헌 (31)
- "Ethereum: A secure decentralised generalised transaction ledger" (2018)[URL]
- "A next-generation smart contract and decentralized application platform"[URL]
- N. Szabo, "Smart contracts: Formalizing and securing relationships on public networks", First Monday, 2(9) (1997)
- "EIP-20: ERC-20 Token Standard" (2015)[URL]
- "Etherscan"[URL]
- H. Moon, "Conformance evaluation of the top-100 Ethereum relationships on public token smart contracts with Ethereum Request for Comment-20 functional specifications", IET Software, 16(2), pp.233~249 (2022)
- "CVE-2021-33403, Integer overflow in LNC token"[URL]
- "CVE-2018-11239, burnOverflow in Hexagon token"[URL]
- "EtherDelta" (2018)[URL]
- T. Chen, "TokenScope: Automatically detecting inconsistent behaviors of cryptocurrency tokens in ethereum", Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS '19), pp.1503~1520 (2019), Association for Computing Machinery
- J. Feist, "Slither: A static analysis framework for smart contracts", Proceedings of the 2nd International Workshop on Emerging Trends in Software Engineering for Blockchain (WETSEB ’19), pp.8~15 (2019), IEEE Press
- E. Hildenbrandt, "KEVM: A complete formal semantics of the ethereum virtual machine", Proceedings of 2018IEEE 31st Computer Security Foundations Symposium (CSF), pp.204~217 (2018)
- J. Liu, "A survey on security verification of blockchain smart contracts", IEEE Access, 7, pp.77894~77904 (2019)
- S. Tikhomirov, "SmartCheck: Static analysis of ethereum smart contracts", Proceedings of 2018 IEEE, 2018, 9~16
- B. Jiang, "ContractFuzzer : Fuzzing smart contracts for vulnerability detection", Proceedings of the 33rd ACM, 2018, 259~269
- S. So, "VERISMART : A highly precise safety verifier for ethereum smart contracts", Proceedings of IEEE Symposium on Security and Privacy (SP), pp.1678~1694 (2020)
- S. So, "SmarTest : Effectively hunting vulnerable transaction sequences in smart contracts through language model-guided symbolic execution", Proceedings of 30th USENIX Security Symposium, pp.1361~1378 (2021)
- J. Frank, "ETHBMC : A bounded model checker for smart contracts", Proceedings of the 29th USENIX Security Symposium, pp.1~18 (2020)
- L. Luu, "Making smart contracts smarter", Proceedings of ACM SIGSAC Conference on Computer and Communications Security (CCS'16), pp.254~269 (2016)
- S. Kalra, "ZEUS : Analyzing safety of smart contracts", Proceedings of 25th Annual Network and Distributed System Security Symposium, pp.1~15 (2018)
- L. Alt, "SMT-Based verification of solidity smart contracts", Proceedings of Leveraging Applications of Formal Methods, Verification and Validation. Industrial Practice: 8th International Symposium, pp.376~388 (2018)
- P. Tsankov, "Securify: Practical security analysis of smart contracts", Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp.67~82 (2018)
- "An ERC-20 test suite"[URL]
- "Compatibility Test Suite" (2020)[URL]
- "Markup Validation Service"[URL]
- "PosixTM Certification" (2020)[URL]
- An Overview of OSI Conformance Testing, "J. Tretmans", ~ (2001)
- G. Ye, "Automated conformance testing for JavaScript engines via deep compiler fuzzing", Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation (PLDI 2021), pp.435~450 (2021)
- "Systematic generation of conformance tests for JavaScript" (2021)[URL]
- N. Atzei, "A survey of attacks on ethereum smart contracts", Proceedings of the 6th International Conference on Principles of Security and Trust, 10204, pp.164~186 (2017)
- "WBTC token smart contract"[URL]