Attack-Centric by Design: A Program-Structure Taxonomy of Smart Contract Vulnerabilities

2025-11-12

AI Summary

Existing smart contract vulnerability classifications are fragmented and symptom-oriented (e.g., reentrancy), lacking a unified, program-structure-based root-cause taxonomy—hindering detection interpretability, audit reproducibility, and security education efficacy. Method: We propose the first attack-origin–driven classification framework grounded in Solidity’s program structure, attributing vulnerabilities to eight fundamental causes spanning control flow, external calls, and state integrity. We systematically map vulnerabilities across SmartBugs, SolidiFI, and other benchmarks to expose label drift and coverage gaps; further, we design a multi-modal detection signal framework integrating static analysis, dynamic execution, and learning-based techniques, accompanied by canonical examples and mitigation guidelines. Contribution/Results: Our framework significantly improves consistency in vulnerability understanding, enables traceable detection via root-cause linkage, and enhances pedagogical practicality—advancing both automated analysis and security education for smart contracts.

Technology Category

• Reasoning under Uncertainty: Causality
• Computer Vision: Adversarial Attacks & Robustness
• Knowledge Representation and Reasoning: Diagnosis and Abductive Reasoning

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Smart contracts concentrate high value assets and complex logic in small, immutable programs, where even minor bugs can cause major losses. Existing taxonomies and tools remain fragmented, organized around symptoms such as reentrancy rather than structural causes. This paper introduces an attack-centric, program-structure taxonomy that unifies Solidity vulnerabilities into eight root-cause families covering control flow, external calls, state integrity, arithmetic safety, environmental dependencies, access control, input validation, and cross-domain protocol assumptions. Each family is illustrated through concise Solidity examples, exploit mechanics, and mitigations, and linked to the detection signals observable by static, dynamic, and learning-based tools. We further cross-map legacy datasets (SmartBugs, SolidiFI) to this taxonomy to reveal label drift and coverage gaps. The taxonomy provides a consistent vocabulary and practical checklist that enable more interpretable detection, reproducible audits, and structured security education for both researchers and practitioners.

Problem

• Unifying fragmented smart contract vulnerability classifications into structural root causes
• Providing consistent taxonomy for interpretable detection and reproducible security audits
• Addressing coverage gaps in existing vulnerability datasets through systematic mapping

Innovation

• Attack-centric program-structure taxonomy for vulnerabilities
• Unifies Solidity vulnerabilities into eight root-cause families
• Cross-maps legacy datasets to reveal label drift