Skip to main content
SpringerLink
Log in

Accurate Smart Contract Verification Through Direct Modelling

  • Conference paper
  • First Online:
Leveraging Applications of Formal Methods, Verification and Validation: Applications (ISoLA 2020)

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 12478))

Included in the following conference series:

Abstract

Smart contracts challenge the existing, highly efficient techniques applied in symbolic model checking of software by their unique traits not present in standard programming models. Still, the majority of reported smart contract verification projects either reuse off-the-shelf model checking tools resulting in inefficient and even unsound models, or apply generic solutions that typically require highly-trained human intervention. In this paper, we present the solution adopted in the formal analysis engine of the official Solidity compiler. We focus on the accurate modeling of the central aspects of smart contracts. For that, we specify purpose-built rules defined in the expressive and highly automatable logic of constrained Horn clauses, which are readily supported by an effective solving infrastructure for establishing sound safety proofs or finite-length counterexamples. We evaluated our approach on an extensive set of smart contracts recently deployed in the Ethereum platform. The reported results show that the approach is able to prove correctness and discover bugs in significantly more contracts than comparable publicly available systems.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Solidity official documentation is available at https://solidity.readthedocs.io.

  2. 2.

    Available at https://github.com/usi-verification-and-security/solc.

  3. 3.

    We considered two other tools for the comparison, namely Zeus [28] and SAFEVM [7], but Zeus is not publicly available and SAFEVM only supports Solidity v0.4.

References

  1. Etherscan. https://etherscan.io

  2. Smtchecker documentation. https://solidity.readthedocs.io/en/v0.6.6/security-considerations.html#formal-verification

  3. Solidity documentation. https://solidity.readthedocs.io

  4. theDAO. https://etherscan.io/address/0xbb9bc244d798123fde783fcc1c72d3bb8c189413

  5. Vyper documentation. https://vyper.readthedocs.io

  6. Parity security alert (2017). https://www.parity.io/security-alert-2/

  7. Albert, E., Correas, J., Gordillo, P., Román-Díez, G., Rubio, A.: SAFEVM: a safety verifier for Ethereum smart contracts. In: Proceedings of the ISSTA 2019, pp. 386–389 (2019)

    Google Scholar 

  8. Alt, L., Reitwiessner, C.: SMT-based verification of solidity smart contracts. In: Margaria, T., Steffen, B. (eds.) ISoLA 2018. LNCS, vol. 11247, pp. 376–388. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-03427-6_28

    Chapter  Google Scholar 

  9. Barrett, K., Cassels, B., Haahr, P., Moon, D.A., Playford, K., Withington, P.T.: A monotonic superclass linearization for Dylan. In: Proceedings of the OOPSLA 1996, pp. 69–82 (1996)

    Google Scholar 

  10. Bhargavan, K., et al.: Formal verification of smart contracts: short paper. In: Proceedings of the PLAS 2016, pp. 91–96 (2016)

    Google Scholar 

  11. Bjørner, N., Gurfinkel, A., McMillan, K., Rybalchenko, A.: Horn clause solvers for program verification. In: Beklemishev, L.D., Blass, A., Dershowitz, N., Finkbeiner, B., Schulte, W. (eds.) Fields of Logic and Computation II. LNCS, vol. 9300, pp. 24–51. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-23534-9_2

    Chapter  Google Scholar 

  12. Blass, A., Gurevich, Y.: Existential fixed-point logic. In: Börger, E. (ed.) Computation Theory and Logic. LNCS, vol. 270, pp. 20–36. Springer, Heidelberg (1987). https://doi.org/10.1007/3-540-18170-9_151

    Chapter  Google Scholar 

  13. Blicha, M., Hyvärinen, A.E.J., Marescotti, M., Sharygina, N.: A cooperative parallelization approach for property-directed k-induction. In: Beyer, D., Zufferey, D. (eds.) VMCAI 2020. LNCS, vol. 11990, pp. 270–292. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-39322-9_13

    Chapter  Google Scholar 

  14. Bradley, A.R.: SAT-based model checking without unrolling. In: Jhala, R., Schmidt, D. (eds.) VMCAI 2011. LNCS, vol. 6538, pp. 70–87. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-18275-4_7

    Chapter  Google Scholar 

  15. ConsenSys: Mythril (2018). https://github.com/ConsenSys/mythril

  16. Erfurt, D., Lundfall, M., Hildenbrandt, E., Livnev, L.: Klab (2020). https://github.com/dapphub/klab

  17. Ethereum Foundation: Ethereum: a secure decentralised generalised transaction ledger (2018). http://ethereum.github.io/yellowpaper/paper.pdf

  18. Ethereum Foundation: Solidity compiler (2018). https://github.com/ethereum/solidity

  19. Ethereum Foundation: HEVM Ethereum evaluator (2020). https://github.com/dapphub/dapptools/tree/master/src/hevm

  20. Feist, J., Grieco, G., Groce, A.: Slither: a static analysis framework for smart contracts. arXiv e-prints arXiv:1908.09878, August 2019

  21. kframework: Solidity semantics (2018). https://github.com/kframework/solidity-semantics

  22. kframework: Vyper semantics (2018). https://github.com/kframework/vyper-semantics

  23. Gurfinkel, A., Kahsai, T., Komuravelli, A., Navas, J.A.: The SeaHorn verification framework. In: Kroening, D., Păsăreanu, C.S. (eds.) CAV 2015. LNCS, vol. 9206, pp. 343–361. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-21690-4_20

    Chapter  Google Scholar 

  24. Hajdu, Á., Jovanović, D.: SMT-friendly formalization of the solidity memory model. ESOP 2020. LNCS, vol. 12075, pp. 224–250. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-44914-8_9

    Chapter  Google Scholar 

  25. Hajdu, Á., Jovanovic, D.: solc-verify: a modular verifier for solidity smart contracts. CoRR abs/1907.04262 (2019)

    Google Scholar 

  26. Hildenbrandt, E., et al.: KEVM: a complete formal semantics of the Ethereum virtual machine. In: Proceedings of the CSF 2018, pp. 204–217 (2018)

    Google Scholar 

  27. Hoare, C.A.R.: An axiomatic basis for computer programming. Commun. ACM 12(10), 576–580 (1969)

    Article  Google Scholar 

  28. Kalra, S., Goel, S., Dhawan, M., Sharma, S.: ZEUS: analyzing safety of smart contracts. In: Proceedings of the NDSS 2018. The Internet Society (2018)

    Google Scholar 

  29. Komuravelli, A., Gurfinkel, A., Chaki, S.: SMT-based model checking for recursive programs. Formal Methods Syst. Des. 48(3), 175–205 (2016). https://doi.org/10.1007/s10703-016-0249-4

    Article  MATH  Google Scholar 

  30. Lahiri, S.K., Chen, S., Wang, Y., Dillig, I.: Formal specification and verification of smart contracts for azure blockchain. CoRR abs/1812.08829 (2018)

    Google Scholar 

  31. Luu, L., Chu, D.H., Olickel, H., Saxena, P., Hobor, A.: Making smart contracts smarter. In: Proceedings of the CCS 2016, pp. 254–269. ACM (2016)

    Google Scholar 

  32. Marescotti, M., Blicha, M., Hyvärinen, A.E.J., Asadi, S., Sharygina, N.: Computing exact worst-case gas consumption for smart contracts. In: Margaria, T., Steffen, B. (eds.) ISoLA 2018. LNCS, vol. 11247, pp. 450–465. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-03427-6_33

    Chapter  Google Scholar 

  33. Marescotti, M., Gurfinkel, A., Hyvärinen, A.E.J., Sharygina, N.: Designing parallel PDR. In: Stewart, D., Weissenbacher, G. (eds.) Proceedings of the FMCAD 2017, pp. 156–163. IEEE (2017)

    Google Scholar 

  34. Mossberg, M., et al.: Manticore: a user-friendly symbolic execution framework for binaries and smart contracts. CoRR abs/1907.03890 (2019)

    Google Scholar 

  35. de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78800-3_24

    Chapter  Google Scholar 

  36. Nikolic, I., Kolluri, A., Sergey, I., Saxena, P., Hobor, A.: Finding the greedy, prodigal, and suicidal contracts at scale. CoRR abs/1802.06038 (2018)

    Google Scholar 

  37. Permenev, A., Dimitrov, D., Tsankov, P., Drachsler-Cohen, D., Vechev, M.: VerX: safety verification of smart contracts. In: Proceedings of the IEEE SSP 2020 (2020, to appear)

    Google Scholar 

  38. Rosu, G., Serbanuta, T.F.: An overview of the K semantic framework. J. Log. Algebraic Program. 79(6), 397–434 (2010)

    Article  MathSciNet  Google Scholar 

  39. Tsankov, P., Dan, A., Drachsler-Cohen, D., Gervais, A., Bünzli, F., Vechev, M.: Securify: practical security analysis of smart contracts. In: Proceedings of the CCS 2018, pp. 67–82. ACM (2018)

    Google Scholar 

  40. Why3: Why3 (2018). http://why3.lri.fr/

Download references

Acknowledgements

The authors would like to thank Enrique Fynn and Fernando Pedone for their kind assistance in providing us with the addresses for the deployed Ethereum contracts used in the experiments. This work is partially supported by the SNSF grant 200021_185031 and by the ERC grant FP7-617805.

Author information

Authors and Affiliations

  1. Università della Svizzera italiana, Lugano, Switzerland

    Matteo Marescotti, Rodrigo Otoni, Patrick Eugster, Antti E. J. Hyvärinen & Natasha Sharygina

  2. Ethereum Foundation, Zug, Switzerland

    Leonardo Alt

Authors
  1. Matteo Marescotti
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Rodrigo Otoni
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Leonardo Alt
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Patrick Eugster
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Antti E. J. Hyvärinen
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Natasha Sharygina
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding authors

Correspondence to Matteo Marescotti , Rodrigo Otoni , Leonardo Alt , Patrick Eugster , Antti E. J. Hyvärinen or Natasha Sharygina .

Editor information

Editors and Affiliations

  1. University of Limerick and Lero, Limerick, Ireland

    Tiziana Margaria

  2. TU Dortmund, Dortmund, Germany

    Bernhard Steffen

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Marescotti, M., Otoni, R., Alt, L., Eugster, P., Hyvärinen, A.E.J., Sharygina, N. (2020). Accurate Smart Contract Verification Through Direct Modelling. In: Margaria, T., Steffen, B. (eds) Leveraging Applications of Formal Methods, Verification and Validation: Applications. ISoLA 2020. Lecture Notes in Computer Science(), vol 12478. Springer, Cham. https://doi.org/10.1007/978-3-030-61467-6_12

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-61467-6_12

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-61466-9

  • Online ISBN: 978-3-030-61467-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation