Source-linked AI summary
Vandal: A Scalable Security Analysis Framework for Smart Contracts
Lexi Brent, Anton Jurisevic, Michael Kong, Eric Liu, Francois Gauthier, Vincent Gramoli, Ralph Holz, Bernhard Scholz
TL;DR
Smart-contract bytecode is difficult to secure because deployed code is immutable and vulnerabilities can cause severe cryptocurrency losses. Vandal translates EVM bytecode into semantic logic relations and lets users specify analyses declaratively in Soufflé. Across 141k unique contracts, it successfully decompiled over 95% with an average runtime of 4.15 seconds and outperformed several existing tools.
Problem
Immutable smart-contract bytecode and vulnerabilities caused by programming, language-design, and toolchain issues motivate frameworks that can analyze deployed low-level code.
Method
Vandal translates low-level EVM bytecode into semantic logic relations and executes declarative security specifications with a Datalog engine.
Results
95% of 141k unique contracts were successfully decompiled with an average runtime of 4.15 seconds, outperforming Oyente, EthIR, Mythril, and Rattle.
Takeaways & Limitations
Vandal provides a logic-driven framework for implementing and evaluating common smart-contract vulnerability analyses at scale.
Takeaways & Limitations
Scraping the whole blockchain is inefficient because of its size, Parity’s hash-based database, and JSON-RPC HTTP-request overheads.
Abstract
from arXiv · showhide
The rise of modern blockchains has facilitated the emergence of smart contracts: autonomous programs that live and run on the blockchain. Smart contracts have seen a rapid climb to prominence, with applications predicted in law, business, commerce, and governance. Smart contracts are commonly written in a high-level language such as Ethereum's Solidity, and translated to compact low-level bytecode for deployment on the blockchain. Once deployed, the bytecode is autonomously executed, usually by a %Turing-complete virtual machine. As with all programs, smart contracts can be highly vulnerable to malicious attacks due to deficient programming methodologies, languages, and toolchains, including buggy compilers. At the same time, smart contracts are also high-value targets, often commanding large amounts of cryptocurrency. Hence, developers and auditors need security frameworks capable of analysing low-level bytecode to detect potential security vulnerabilities. In this paper, we present Vandal: a security analysis framework for Ethereum smart contracts. Vandal consists of an analysis pipeline that converts low-level Ethereum Virtual Machine (EVM) bytecode to semantic logic relations. Users of the framework can express security analyses in a declarative fashion: a security analysis is expressed in a logic specification written in the \souffle language. We conduct a large-scale empirical study for a set of common smart contract security vulnerabilities, and show the effectiveness and efficiency of Vandal. Vandal is both fast and robust, successfully analysing over 95\% of all 141k unique contracts with an average runtime of 4.15 seconds; outperforming the current state of the art tools---Oyente, EthIR, Mythril, and Rattle---under equivalent conditions.
1 Introduction
Vandal addresses smart-contract security risks by translating low-level EVM bytecode into logic relations and expressing vulnerability analyses declaratively. Its pipeline and empirical study demonstrate broad analysis coverage, with reported robustness and efficiency against existing tools.
- Motivation: Immutable deployed bytecode and severe real-world exploits make smart-contract security analysis important.Reported incidents include The DAO reentrancy attack and multiple Parity and integer-overflow exploits involving millions of dollars in cryptocurrency.
- Motivation: Vandal directly analyzes smart-contract bytecode to address vulnerabilities arising from programming, language-design, and toolchain issues.The framework applies a logic-driven static-analysis approach to low-level bytecode.
- Framework: Declarative logic specifications and a Datalog engine produce detected vulnerabilities and locations from relations encoding each contract.Vandal uses Soufflé to synthesize performant C++ code from the logic specifications.
- Framework: Vandal’s pipeline scrapes bytecode, disassembles it, decompiles it to register-transfer language, and extracts semantic logic relations.The extracted relations expose data- and control-flow dependencies for subsequent analyses.
- Analyses: Vandal implements logic-based analyses for unchecked send, reentrancy, unsecured balance, destroyable contract, and use of origin vulnerabilities.The framework also provides a static-analysis library exposing control-flow, EVM-operation, data-dependency, and control-dependency properties.
- Evaluation: 95% of 141k unique contracts were successfully decompiled, with an average runtime of 4.15 seconds, while outperforming Oyente, EthIR, Mythril, and Rattle.The empirical analysis covered all 141k unique smart contracts scraped from the public blockchain.
2 The Vandal Framework
Vandal translates Ethereum bytecode through multiple stages into logic relations that expose program structure for declarative security analysis. Its design addresses the difficulty of recovering control- and data-flow from EVM’s low-level stack-based representation.
- Logic-driven analysis: Vandal expresses security analyses in Soufflé logic specifications executed over relations encoding contract bytecode.The engine produces output relations listing detected vulnerabilities and their bytecode locations.
- Pipeline stages: The pipeline scrapes contract bytecode, disassembles it into address-annotated mnemonics, and decompiles it into register transfer language.The scraper traverses blockchain transactions and traces to find contract creations, while the disassembler performs a linear scan.
- Scraper: The scraper’s full-blockchain workflow is constrained by storage size, hash-based database access, and JSON-RPC overhead.A fully traced synchronization can exceed 1.5TB.
- Decompiler: The decompiler reconstructs control flow by identifying basic blocks, symbolically executing them, and replacing stack operations with register-transfer operations.Symbolic labels represent stack locations across basic blocks, allowing data dependencies to be resolved in a later phase.
3 Use-Case Study: Security Analyses in Vandal
Vandal demonstrates how common smart-contract vulnerabilities can be expressed as Soufflé Datalog analyses over bytecode-derived relations. The case studies cover unchecked send, reentrancy, and unsecured balance vulnerabilities, including their operational detection conditions.
- Analysis approach: Vandal expresses security analyses as Soufflé Datalog specifications over relations derived from smart-contract bytecode.Its static analysis library supplies relations used by vulnerability-specific rules.
- Unchecked send: Unchecked send is flagged when a call’s return value is not used to throw or update persistent state.The rule identifies calls whose success or failure produces no tangible action.
- Reentrancy: Reentrancy can drain Ether when an external call occurs before a user’s balance is updated, allowing recursive calls to reuse the unchanged balance.The example updates accounts[msg.sender] only after sending Ether; a safer ordering updates state before the call.
- Reentrancy: Vandal flags a call as reentrant when it can recur into the enclosing contract, forwards sufficient gas, and lacks mutex protection.The implementation uses call reachability, gas dependence, and protection relations.
- Unsecured balance: Unsecured balance vulnerabilities arise when arbitrary callers can gain ownership or otherwise force Ether transfers to manipulated addresses.A misnamed constructor can become public, letting anyone assume ownership and withdraw funds intended for the rightful owner.
- Unsecured balance: Directly initializing the owner during contract creation prevents later updates from within a function in the safe example.This removes the misnamed public constructor that enabled unauthorized ownership changes.
4 Experimental Evaluation
Vandal is evaluated against 141k unique Ethereum contract bytecodes and compared with four existing tools. It achieves high analysis coverage, low error rates, and the best average runtime under the reported experimental conditions.
- Bytecode corpus: 141k unique contract bytecodes form the evaluation corpus, selected from 7.4M deployed contracts as of block 6237983.The corpus contains one entry per unique bytecode.
- Bytecode corpus: Higher-complexity bytecodes control greater Ether balances, while most contain 100 to 1k basic blocks.Many duplicated bytecodes control more than 100 Ether, making exploits potentially capable of compromising thousands of accounts.
- Tool comparison: Vandal outperforms Oyente, EthIR, Rattle, and Mythril in average runtime per successfully analyzed contract.Reported total runtimes include unsuccessful contracts, so they are not directly correlated with average runtimes.
- Tool comparison: Over 95% of contracts are successfully decompiled by Vandal, which exits in an error state for only 0.1% of contracts.Figure 10 compares successful analysis, timeout, and error percentages across tools using a 60-second decompilation timeout.
- Vulnerability detection: Vandal flags a higher percentage of contracts than Mythril for every listed analysis except reentrancy.The reentrancy difference is less than 1%; the authors attribute it to noisy data associated with Mythril’s high error rate.
5 Related Work
Prior smart-contract analysis spans dynamic symbolic execution, formal verification, and abstract interpretation, each with scalability or completeness trade-offs. Vandal instead applies abstract interpretation directly to EVM bytecode through a purpose-built analyzable intermediate representation.
- Exploit identification and analysis: Dynamic symbolic-execution systems explore only some program paths and are therefore fundamentally unsound.Oyente, maian, gasper, and related systems use dynamic symbolic execution or trace semantics.
- Exploit identification and analysis: Semi-automated formal verification can provide complete analyses but requires substantial manual proof construction and does not scale to millions of contracts.These approaches rely on interactive theorem provers such as Isabelle/HOL, F*, Why3, and K.
- Exploit identification and analysis: Abstract interpretation avoids human intervention but introduces false positives in existing smart-contract frameworks.Examples include translating Solidity to LLVM or abstracting Solidity into finite-state automata.
- Vandal’s position: Vandal combines abstract interpretation with direct EVM-bytecode analysis using a purpose-built decompiler and analyzable intermediate representation.This distinguishes it from approaches that begin with Solidity source code.
- Coverage of vulnerabilities: Existing tools differ in vulnerability coverage, with Oyente identifying four classes while some formal-verification tools detect three classes.The compared classes include transaction-ordering dependence, timestamp dependence, call-stack attacks, reentrancy, external-call return checks, and related vulnerabilities.
6 Conclusion
Vandal combines a decompiling static-analysis pipeline with logic-driven vulnerability specifications and was evaluated at Ethereum scale against established tools.
- Vandal decompiles bytecode through abstract interpretation into higher-level logic relations and provides a static-analysis library for developing vulnerability specifications.Analyses can often be implemented in only a few lines of Soufflé code.
- 191k unique smart contracts scraped from Ethereum were included in Vandal’s large-scale empirical experiment.
- Vandal outperformed Oyente, EthIR, Mythril, and Rattle in average analysis time and error rate.