A Survey on Security Verification of Blockchain Smart Contracts <s> B. VULNERABILITY SCANNING <s> Half a decade after Bitcoin became the first widely used cryptocurrency, blockchains are receiving considerable interest from industry and the research community. Modern blockchains feature services such as name registration and smart contracts. Some employ new forms of consensus, such as proof-of-stake instead of proof-of-work. However, these blockchains are so far relatively poorly investigated, despite the fact that they move considerable assets. In this paper, we explore three representative, modern blockchains---Ethereum, Namecoin, and Peercoin. Our focus is on the features that set them apart from the pure currency use case of Bitcoin. We investigate the blockchains' activity in terms of transactions and usage patterns, identifying some curiosities in the process. For Ethereum, we are mostly interested in the smart contract functionality it offers. We also carry out a brief analysis of issues that are introduced by negligent design of smart contracts. In the case of Namecoin, our focus is how the name registration is used and has developed over time. For Peercoin, we are interested in the use of proof-of-stake, as this consensus algorithm is poorly understood yet used to move considerable value. Finally, we relate the above to the fundamental characteristics of the underlying peer-to-peer networks. We present a crawler for Ethereum and give statistics on the network size. For Peercoin and Namecoin, we identify the relatively small size of the networks and the weak bootstrapping process. <s> BIB001 </s> A Survey on Security Verification of Blockchain Smart Contracts <s> B. VULNERABILITY SCANNING <s> Smart contracts are computer programs that can be correctly executed by a network of mutually distrusting nodes, without the need of an external trusted authority. Since smart contracts handle and transfer assets of considerable value, besides their correct execution it is also crucial that their implementation is secure against attacks which aim at stealing or tampering the assets. We study this problem in Ethereum, the most well-known and used framework for smart contracts so far. We analyse the security vulnerabilities of Ethereum smart contracts, providing a taxonomy of common programming pitfalls which may lead to vulnerabilities. We show a series of attacks which exploit these vulnerabilities, allowing an adversary to steal money or cause other damage. <s> BIB002
Vulnerabilities caused by contract design defects can also cause huge losses. Vulnerability scanning is the study of vulnerabilities that have been discovered, which aimed at avoiding the same mistakes. It can help us discover potential vulnerabilities in the execution of contracts, which is important to improve the security and credibility of contracts. To avoid the vulnerabilities, some studies systematically summarized the contract vulnerabilities caused by negligent design in recent years and analyzed the security risks in the contract BIB002 , BIB001 . For example, Atzei et al. BIB002 summed up the contract vulnerabilities that have been discovered into 12 categories, explaining the reasons for the vulnerabilities. At present, reentrancy (DAO attack event), access control (Parity wallet stolen event), denial of services, bad randomness have caused huge losses in the discovered vulnerabilities, so it is important to avoid the recurrence of the vulnerability. To solve the vulnerabilities, there are special solutions and common solutions that have been proposed. Below we discuss these two aspects.