A Static Analysis-based Platform-as-Service to Improve the Quality of Smart Contracts

Dinis Antunes Palha de Araújo

Key information

Authors:

Dinis Antunes Palha de Araújo (Dinis Antunes Palha de Araújo)

Supervisors:

Rui Filipe Lima Maranhão de Abreu; João Fernando Peixoto Ferreira (João Fernando Peixoto Ferreira)

Published in

November 15, 2021

Abstract

Blockchain technology promises consensus on a decentralized, immutable digital ledger maintained by a peer-to-peer network involving nodes that do not trust each other. Such technology has gained both popularity and financial value. Likewise, Ethereum's Smart Contracts followed this trend, by promising distributed computations without the need for a third party. More than one and a half million smart contracts have been deployed to the Ethereum Blockchain where some have been known to have security vulnerabilities. Recent attacks on these vulnerabilities result in great financial losses and due to the smart contract immutability these cannot be patched. Many static analysis tools have been created for Smart Contracts and SmartBugs was created as an extensible framework that aggregates them with the goal of detecting different vulnerability types. While using SmartBugs, developers tend to find themselves with a huge overhead on parsing the outputs, unifying the results and acknowledging the information produced by this tool. In this dissertation we describe SARIF, a standard format for the output of static analysis tools. We then discuss how we converted the 11 tools run by SmartBugs to this format. Moreover, we develop SASP, a protocol server, as a service to receive queries, run the analysis and aggregate the results. Finally, we overview the GitHub pull based development platform as a methodology to automate the analysis and show its results in a more intuitive manner. Our goal is to increase the accessibility of static analysis tools to smart contract developers.