A Language for Smart Contracts with Secure Control Flow (Technical Report)
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866910916669341696 |
|---|---|
| author | Yao, Siqiu Ni, Haobin Ma, Stephanie Schiff, Noah Myers, Andrew C. Cecchetti, Ethan |
| author_facet | Yao, Siqiu Ni, Haobin Ma, Stephanie Schiff, Noah Myers, Andrew C. Cecchetti, Ethan |
| contents | Smart contracts are frequently vulnerable to control-flow attacks based on confused deputies, reentrancy, and incorrect error handling. These attacks exploit the complexity of interactions among multiple possibly unknown contracts. Existing best practices to prevent vulnerabilities rely on code patterns and heuristics that produce both false positives and false negatives. Even with extensive audits and heuristic tools, new vulnerabilities continue to arise, routinely costing tens of millions of dollars.
We introduce SCIF, a language for secure smart contracts, that addresses these classes of control-flow attacks. By extending secure information flow mechanisms in a principled way, SCIF enforces both classic end-to-end information flow security and new security restrictions on control flow, even when SCIF contracts interact with malicious non-SCIF code. SCIF is implemented as a compiler to Solidity. We show how SCIF can secure contracts with minimal overhead through case studies of applications with intricate security reasoning and a large corpus of insecure code. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2407_01204 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | A Language for Smart Contracts with Secure Control Flow (Technical Report) Yao, Siqiu Ni, Haobin Ma, Stephanie Schiff, Noah Myers, Andrew C. Cecchetti, Ethan Cryptography and Security Programming Languages Smart contracts are frequently vulnerable to control-flow attacks based on confused deputies, reentrancy, and incorrect error handling. These attacks exploit the complexity of interactions among multiple possibly unknown contracts. Existing best practices to prevent vulnerabilities rely on code patterns and heuristics that produce both false positives and false negatives. Even with extensive audits and heuristic tools, new vulnerabilities continue to arise, routinely costing tens of millions of dollars. We introduce SCIF, a language for secure smart contracts, that addresses these classes of control-flow attacks. By extending secure information flow mechanisms in a principled way, SCIF enforces both classic end-to-end information flow security and new security restrictions on control flow, even when SCIF contracts interact with malicious non-SCIF code. SCIF is implemented as a compiler to Solidity. We show how SCIF can secure contracts with minimal overhead through case studies of applications with intricate security reasoning and a large corpus of insecure code. |
| title | A Language for Smart Contracts with Secure Control Flow (Technical Report) |
| topic | Cryptography and Security Programming Languages |
| url | https://arxiv.org/abs/2407.01204 |