Protecting confidentiality and integrity of sensitive information in blockchain software systems is an important security aspect, which may be compromised due to unrestricted information flow along the control structures of smart contracts during their execution. Language-based information flow security analysis is a promising technique, which aims to detect possible unauthorized leakage of sensitive information or corruption of data values in critical computations of software systems. In this chapter, we extend traditional language-based information flow analysis to the case of Ethereum Solidity smart contracts in order to identify possible undesirable information flow in the contract codes that may be the source of the aforementioned software vulnerabilities. In particular, we apply data-flow analysis which accumulates (direct/indirect) dependency information among the smart contract variables, indicating possible information flow along all possible paths in the smart contract. To this end, we define concrete semantics of Solidity language and we design its abstraction in the domain of positive propositional formula Pos, which encodes variables’ dependencies in the form of logical formula. Insecure information flow is then detected based on their satisfiability using truth value assignments according to the variables’ security levels. We discuss precision improvement by combining Pos with other numerical abstract domains and various challenges in this research direction.

Analyzing information flow in solidity smart contracts

Halder, Raju;Cortesi, Agostino
2023-01-01

Abstract

Protecting confidentiality and integrity of sensitive information in blockchain software systems is an important security aspect, which may be compromised due to unrestricted information flow along the control structures of smart contracts during their execution. Language-based information flow security analysis is a promising technique, which aims to detect possible unauthorized leakage of sensitive information or corruption of data values in critical computations of software systems. In this chapter, we extend traditional language-based information flow analysis to the case of Ethereum Solidity smart contracts in order to identify possible undesirable information flow in the contract codes that may be the source of the aforementioned software vulnerabilities. In particular, we apply data-flow analysis which accumulates (direct/indirect) dependency information among the smart contract variables, indicating possible information flow along all possible paths in the smart contract. To this end, we define concrete semantics of Solidity language and we design its abstraction in the domain of positive propositional formula Pos, which encodes variables’ dependencies in the form of logical formula. Insecure information flow is then detected based on their satisfiability using truth value assignments according to the variables’ security levels. We discuss precision improvement by combining Pos with other numerical abstract domains and various challenges in this research direction.
2023
Distributed Computing to Blockchain
File in questo prodotto:
File Dimensione Formato  
book_blockchain_elsevier_cap7.pdf

non disponibili

Tipologia: Versione dell'editore
Licenza: Accesso chiuso-personale
Dimensione 7.74 MB
Formato Adobe PDF
7.74 MB Adobe PDF   Visualizza/Apri

I documenti in ARCA sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/10278/5020160
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 0
  • ???jsp.display-item.citation.isi??? ND
social impact