Smart Contract Vulnerabilities, Tools, and Benchmarks: An Updated Systematic Literature Review

2024-12-02

arXiv.org

AI Summary

Ethereum smart contracts face severe security challenges due to immutability and transparency, yet existing vulnerability detection tools lack systematic evaluation of effectiveness. To address this gap, we conduct a large-scale, systematic literature review (SLR), rigorously selecting and analyzing 222 high-quality papers from an initial pool of 3,380 studies. We propose the first hierarchical taxonomy covering 14 vulnerability categories and 192 distinct vulnerability types. Further, we introduce a novel “tool–vulnerability–benchmark” ternary mapping framework, unifying 219 detection tools and 133 evaluation benchmarks for the first time. Our contributions include: (1) a standardized vulnerability classification schema; (2) a comprehensive functional matrix of all surveyed tools; (3) a fine-grained tool–vulnerability matching atlas; and (4) a reusable, harmonized benchmark suite. This work establishes an authoritative, extensible knowledge infrastructure for smart contract security research, substantially enhancing comparability, reproducibility, and methodological rigor in vulnerability detection studies.

Technology Category

• Constraint Satisfaction and Optimization: Solvers and Tools
• Search and Optimization: Evaluation and Analysis
• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

Smart contracts are self-executing programs on blockchain platforms like Ethereum, which have revolutionized decentralized finance by enabling trustless transactions and the operation of decentralized applications. Despite their potential, the security of smart contracts remains a critical concern due to their immutability and transparency, which expose them to malicious actors. Numerous solutions for vulnerability detection have been proposed, but it is still unclear which one is the most effective. This paper presents a systematic literature review that explores vulnerabilities in Ethereum smart contracts, focusing on automated detection tools and benchmark evaluation. We reviewed 3,380 studies from five digital libraries and five major software engineering conferences, applying a structured selection process that resulted in 222 high-quality studies. The key results include a hierarchical taxonomy of 192 vulnerabilities grouped into 14 categories, a comprehensive list of 219 detection tools with corresponding functionalities, methods, and code transformation techniques, a mapping between our taxonomy and the list of tools, and a collection of 133 benchmarks used for tool evaluation. We conclude with a discussion about the insights into the current state of Ethereum smart contract security and directions for future research.

Problem

• Identifying and classifying Ethereum smart contract vulnerabilities systematically
• Evaluating effectiveness of automated tools for vulnerability detection
• Providing benchmarks for assessing smart contract security tools

Innovation

• Systematic review of 222 high-quality studies
• Hierarchical taxonomy of 192 vulnerabilities
• Comprehensive list of 219 detection tools