OnChain Analysis for Detecting Reentrancy Vulnerability in Ethereum Smart Contracts

Abstract

Vulnerabilities are continuously discovered and common in all software platforms. Ethereum smart contracts are no exception and critical vulnerabilities are continuously discovered. Turing complete blockchain concept is relatively new and its diverse applications are being developed, continuously but the vulnerability research is not matured yet like traditional languages. Conceptually ethereum solidity language is different than traditional languages and the programmer is also not used to blockchain-based programming, thus coding error leads to critical vulnerabilities. Recently, different smart contract testing (off-chain fuzzing) frameworks have been proposed but their scope is limited to a single contract testing. Recently, ethereum application like decentralized autonomous organization (DAO) has introduced complexity (multiple smart contract based application) and an efficient cross-contract testing framework is required. In this research, we have proposed an alternative approach (on-chain) to test the vulnerabilities at runtime (unlike fuzzing), in the already deployed smart contracts. We have proposed a set of features extracted from the transactions and an algorithm that can detect the transactions; exploiting the reentrancy vulnerability. The proposed framework can be used to check transactions before the consensus algorithm agrees to include a transaction in ethereum blockchain.