A Survey on Security Verification of Blockchain Smart Contracts <s> 2) THE SOLUTION FOR COMMON VULNERABILITIES <s> We identify three design principles for reflection and metaprogramming facilities in object oriented programming languages. Encapsulation: meta-level facilities must encapsulate their implementation. Stratification: meta-level facilities must be separated from base-level functionality. Ontological correspondence: the ontology of meta-level facilities should correspond to the ontology of the language they manipulate. Traditional/mainstream reflective architectures do not follow these precepts. In contrast, reflective APIs built around the concept of mirrors are characterized by adherence to these three principles. Consequently, mirror-based architectures have significant advantages with respect to distribution, deployment and general purpose metaprogramming. <s> BIB001 </s> A Survey on Security Verification of Blockchain Smart Contracts <s> 2) THE SOLUTION FOR COMMON VULNERABILITIES <s> Cryptocurrencies record transactions in a decentralized data structure called a blockchain. Two of the most popular cryptocurrencies, Bitcoin and Ethereum, support the feature to encode rules or scripts for processing transactions. This feature has evolved to give practical shape to the ideas of smart contracts, or full-fledged programs that are run on blockchains. Recently, Ethereum's smart contract system has seen steady adoption, supporting tens of thousands of contracts, holding millions dollars worth of virtual coins. In this paper, we investigate the security of running smart contracts based on Ethereum in an open distributed network like those of cryptocurrencies. We introduce several new security problems in which an adversary can manipulate smart contract execution to gain profit. These bugs suggest subtle gaps in the understanding of the distributed semantics of the underlying platform. As a refinement, we propose ways to enhance the operational semantics of Ethereum to make contracts less vulnerable. For developers writing contracts for the existing Ethereum system, we build a symbolic execution tool called Oyente to find potential security bugs. Among 19, 336 existing Ethereum contracts, Oyente flags 8, 833 of them as vulnerable, including the TheDAO bug which led to a 60 million US dollar loss in June 2016. We also discuss the severity of other attacks for several case studies which have source code available and confirm the attacks (which target only our accounts) in the main Ethereum network. <s> BIB002 </s> A Survey on Security Verification of Blockchain Smart Contracts <s> 2) THE SOLUTION FOR COMMON VULNERABILITIES <s> Solidity is a language used for smart contracts on the Ethereum blockchain. Smart contracts are embedded procedures stored with the data they act upon. Debugging smart contracts is a really difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded. In this paper, we address the lack of inspectability of a deployed contract by analyzing contract state using decompilation techniques driven by the contract structure definition. Our solution, SmartInspect, also uses a mirror-based architecture to represent locally object responsible for the interpretation of the contract state. SmartInspect allows contract developers to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code. <s> BIB003 </s> A Survey on Security Verification of Blockchain Smart Contracts <s> 2) THE SOLUTION FOR COMMON VULNERABILITIES <s> Smart contracts that build up on blockchain technologies are receiving great attention in new business applications and the scientific community, because they allow untrusted parties to manifest contract terms in program code and thus eliminate the need for a trusted third party. The creation process of writing well performing and secure contracts in Ethereum, which is today’s most prominent smart contract platform, is a difficult task. Research on this topic has only recently started in industry and science. Based on an analysis of collected data with Grounded Theory techniques, we have elaborated several common security patterns, which we describe in detail on the basis of Solidity, the dominating programming language for Ethereum. The presented patterns describe solutions to typical security issues and can be applied by Solidity developers to mitigate typical attack scenarios. <s> BIB004 </s> A Survey on Security Verification of Blockchain Smart Contracts <s> 2) THE SOLUTION FOR COMMON VULNERABILITIES <s> The blockchain based decentralized cryptocurrency platforms are one of the hottest topics in tech at the moment. Though most of the interest is generated by cryptocurrency related activities, it is becoming apparent that a much wider spectrum of applications can leverage the blockchain technology. The primary concepts enabling such general use of the blockchain are the so-called smart contracts, which are special programs that run on the blockchain. One of the most popular blockchain platforms that supports smart contracts are Ethereum. As smart contracts typically handle money, ensuring their low number of faults and vulnerabilities are essential. To aid smart contract developers and help maturing the technology, we need analysis tools and studies for smart contracts. As an initiative for this, we propose the adoption of some well-known OO metrics for Solidity smart contracts. Furthermore, we analyze more than 10,000 smart contracts with our prototype tool. The results suggest that smart contract programs are short, not overly complex and either quite well-commented or not commented at all. Moreover, smart contracts could benefit from an external library and dependency management mechanism, as more than 80% of the defined libraries in Solidity files code the same functionalities. <s> BIB005 </s> A Survey on Security Verification of Blockchain Smart Contracts <s> 2) THE SOLUTION FOR COMMON VULNERABILITIES <s> Smart contracts---stateful executable objects hosted on blockchains like Ethereum---carry billions of dollars worth of coins and cannot be updated once deployed. We present a new systematic characterization of a class of trace vulnerabilities, which result from analyzing multiple invocations of a contract over its lifetime. We focus attention on three example properties of such trace vulnerabilities: finding contracts that either lock funds indefinitely, leak them carelessly to arbitrary users, or can be killed by anyone. We implemented Maian, the first tool for specifying and reasoning about trace properties, which employs interprocedural symbolic analysis and concrete validator for exhibiting real exploits. Our analysis of nearly one million contracts flags 34, 200 (2, 365 distinct) contracts vulnerable, in 10 seconds per contract. On a subset of 3, 759 contracts which we sampled for concrete validation and manual analysis, we reproduce real exploits at a true positive rate of 89%, yielding exploits for 3, 686 contracts. Our tool finds exploits for the infamous Parity bug that indirectly locked $200 million US worth in Ether, which previous analyses failed to capture. <s> BIB006
In addition, some other work gave the solutions to common vulnerabilities. Bragagnolo et al. BIB003 proposed a SmartInspect architecture based on decompilation capabilities encapsulated in mirrors. It obtained unstructured information in the contract by decompiling the smart contract that had been deployed, so that they could introspect the current state of a smart contract instance. If any vulnerabilities were found, it can modify them without redepoly BIB001 . Wohrer and Zdun BIB004 proposed six security design patterns to reduce the possibility of the vulnerabilities. Besides, many tools had been designed to analyze the contracts, where the Oyente tool had achieved significant results. It extracted the control map from the EVM Bytecode of the contract and found potential vulnerabilities in the contract by executing the control map BIB002 . Similarly, there were also other verification tools, such as SolMet BIB005 , MAIAN BIB006 , ZEUS  , Securify  , Mythril  , SmartDec  , and Solgraph [52] . The first five tools analyzed the EVM Bytecode to check possible vulnerabilities during execution, and the last two tools analyzed the code of the original contract to find potential vulnerabilities. Using vulnerability scanning method, we can more conveniently and comprehensively detect possible vulnerabilities in contracts when they are executing. So vulnerability scanning method is necessary for developing correct smart contracts.