Collateral Use of Deployment Code for Smart Contracts in Ethereum

Monika Di Angelo, G. Salzer
{"title":"Collateral Use of Deployment Code for Smart Contracts in Ethereum","authors":"Monika Di Angelo, G. Salzer","doi":"10.1109/NTMS.2019.8763828","DOIUrl":null,"url":null,"abstract":"Ethereum is still the most prominent platform for smart contracts. For the deployment of contracts on its blockchain, the so-called deployment code is executed by Ethereum's virtual machine. As it turns out, deployment code can do a lot more than merely deploying a contract. This paper identifies less-anticipated uses of contract deployment in Ethereum by analyzing the available blockchain data. In particular, we analyze the specifics of deployment code used beyond actually deploying a contract in a quantitative and qualitative manner. To this end, we identify code patterns in deployment code by distilling recurring code skeletons from all external transactions and internal messages that contain deployment code. Tracking the use of these patterns reveals a set of vulnerabilities in contracts targeted by skillfully crafted deployment code. We summarize the encountered exploitative cases of collateral use of deployment code and report respective quantities. Example scenarios illustrate the recent usage. Collateral use of deployment code starts to appear in the middle of 2018 and becomes dominant among contract creations in autumn of 2018. We intend to raise awareness about the less obvious uses of deployment code and its potential security issues.","PeriodicalId":368680,"journal":{"name":"2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2019-06-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"4","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/NTMS.2019.8763828","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 4

Abstract

Ethereum is still the most prominent platform for smart contracts. For the deployment of contracts on its blockchain, the so-called deployment code is executed by Ethereum's virtual machine. As it turns out, deployment code can do a lot more than merely deploying a contract. This paper identifies less-anticipated uses of contract deployment in Ethereum by analyzing the available blockchain data. In particular, we analyze the specifics of deployment code used beyond actually deploying a contract in a quantitative and qualitative manner. To this end, we identify code patterns in deployment code by distilling recurring code skeletons from all external transactions and internal messages that contain deployment code. Tracking the use of these patterns reveals a set of vulnerabilities in contracts targeted by skillfully crafted deployment code. We summarize the encountered exploitative cases of collateral use of deployment code and report respective quantities. Example scenarios illustrate the recent usage. Collateral use of deployment code starts to appear in the middle of 2018 and becomes dominant among contract creations in autumn of 2018. We intend to raise awareness about the less obvious uses of deployment code and its potential security issues.
以太坊智能合约部署代码的附带使用
以太坊仍然是智能合约最突出的平台。对于在其区块链上部署合约,所谓的部署代码由以太坊的虚拟机执行。事实证明,部署代码可以做的不仅仅是部署一个契约。本文通过分析可用的区块链数据,确定了以太坊中合同部署的较少预期用途。特别是,我们以定量和定性的方式分析了实际部署合同之外使用的部署代码的细节。为此,我们通过从包含部署代码的所有外部事务和内部消息中提取循环代码骨架来识别部署代码中的代码模式。跟踪这些模式的使用,可以发现精心设计的部署代码所针对的契约中的一组漏洞。我们总结了所遇到的附带使用部署代码的利用案例,并报告了各自的数量。示例场景说明了最近的用法。部署代码的附带使用在2018年中期开始出现,并在2018年秋季成为合同创建的主导。我们打算提高人们对部署代码不太明显的用途及其潜在安全问题的认识。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
自引率
0.00%
发文量
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信