Search papers, labs, and topics across Lattice.
This paper explores the effectiveness of smart contract invariants as a defense mechanism against cybercriminal attacks on blockchains, a critical issue given the billions lost to vulnerabilities. By employing a novel experimental protocol, the authors analyze how these invariants could have mitigated past exploits and assess the capabilities of current automated tools in identifying them. The results show that smart contract invariants successfully block all attacks in a benchmark of 28 real Ethereum exploits, validated through extensive transaction replays, underscoring their potential as a robust security solution.
Smart contract invariants could have prevented all attacks in a benchmark of real-world Ethereum exploits, showcasing a powerful new defense against blockchain vulnerabilities.
Blockchains are among the most adversarial environments in computing. Billions are stolen by cybercriminals who exploit vulnerabilities. This is an open problem and no concept or technique has proven to really make a difference. In this paper, we claim that the classical notion of program invariant is perhaps the most powerful solution to the problem. We devise anoriginal experimental protocol to 1) study how invariants would have protected against past real-world attacks and 2) whether state-of-the-art automated tools can find them. The experimental toolchain is sophisticated. It is based on INVARIANTEVAL, a benchmark of 28 real Ethereum exploits, each paired with a human-authored invariant that blocks the attack. We validate every invariant with PONDEREPLAY, a replay framework that re-executes transactions in order to prove the correctness and soundness of smart contract invariants. We demonstrate that smart contract invariants block all the cybercriminal attacks in INVARIANTEVAL, fully validated by replaying 108,637 historical transactions. Our large-scale experiments clearly demonstrate that smart contract invariants protect against cybercriminals.
