Verifying Solidity Smart Contracts Via Communication Abstraction in SmartACERemote
Solidity smart contract allow developers to formalize financial agreements between users. Due to their monetary nature, smart contracts have been the target of many high-profile attacks. Brute-force verification of smart contracts that maintain data for up to 2^{160} users is intractable. In this paper, we present SmartACE, an automated framework for smart contract verification. To ameliorate the state explosion induced by large numbers of users, SmartACE implements local bundle abstractions that reduce verification from arbitrarily many users to a few representative users. To uncover deep bugs spanning multiple transactions, SmartACE employs a variety of techniques such as model checking, fuzzing, and symbolic execution. To illustrate the effectiveness of SmartACE, we verify several contracts from the popular OpenZeppelin library: an access-control policy and an escrow service. For each contract, we provide specifications in the Scribble language and apply fault injection to validate each specification. We report on our experience integrating Scribble with SmartACE, and describe the performance of SmartACE on each specification.
Sun 16 JanDisplayed time zone: Eastern Time (US & Canada) change
13:30 - 14:30 | Privacy and SecurityVMCAI at Salon I Chair(s): Vincenzo Arceri University of Parma - Department of Mathematical, Physical, and Computer Sciences | ||
13:30 30mPaper | Verifying Pufferfish Privacy in Hidden Markov ModelsRemote VMCAI Depeng Liu Institute of Software, Chinese Academy of Sciences, Bow-Yaw Wang Academia Sinica, Lijun Zhang Institute of Software, Chinese Academy of Sciences | ||
14:00 30mPaper | Verifying Solidity Smart Contracts Via Communication Abstraction in SmartACERemote VMCAI Scott Wesley University of Waterloo, Canada, Maria Christakis MPI-SWS, Jorge A. Navas Certora, inc., Richard Trefler University of Waterloo, Canada, Valentin Wüstholz ConsenSys, Arie Gurfinkel University of Waterloo |