Towards a Solider Solidity

• Autor(a) principal: Reis, João Carlos Raposo dos
• Data de Publicação: 2023
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10362/167656
• topic: Domínio/Área Científica::Engenharia e Tecnologia::Engenharia Eletrotécnica, Eletrónica e Informática

Blockchains are being widely adopted since its inception. Since Ethereum popularized smart contracts and introduced its platform for developing and deploying these programs on the blockchain, there has been an unprecedented boom in decentralized applications (dApps). Smart contracts bring a new flexibility which we didn’t see in the beginning with the first generation blockchains. These programs rule important agreements between two parties involving transacting valuable assets between them. Recently we have seen a record of stealing assets from the blockchain , as they exploded and became more popular in 2020. Many known vulnerabilities include: Re-entrancy, Gasless Send, Phishing with tx.origin and Type Casts. This reinforces the importance to ensure that these programs are correct. However this is still a hard task, as the programming languages used to developed them often do not really help and smart contracts are still being exploited. Static analysis tools can prevent these bugs, if they are robust enough to detect most of the vulnerabilities which are known and not known, and ensure that these contracts are developed with the best design practices. Many of those existing tools and programming languages are still in a very early stage and not yet prepared to be used in production environments. The development of smart contracts can be done in two types of languages: domain- specific and general-purpose languages. Domain-specific languages, specifically designed for writing smart contracts, are generally considered safer than their general-purpose counterparts. Solidity, created by the Ethereum Foundation, is a DSL and stands out as the most popular language to date. However, it is not without its flaws, primarily stemming from its complexity and Turing completeness. While recent academic efforts have introduced languages aimed at addressing known vulnerabilities in Solidity, the language’s widespread adoption needs continuous improvements to improve its safety. Our contribution targets a vulnerability in Solidity related to Type Casts. We introduce a proof-of-concept language inspired by Featherweight Solidity, a formalization of Solidity as a subset with an improved type system. Specifically, our language features an extended typing address to mitigate this vulnerability.