Publication: Meta-herramienta para el análisis de vulnerabilidades en contratos inteligentes
Loading...
Official URL
Full text at PDC
Publication Date
2020-06
Authors
Advisors (or tutors)
López Vivar, Antonio
Editors
Journal Title
Journal ISSN
Volume Title
Publisher
Citations
Exportar
Abstract
Con el nacimiento en el 2008 de Bitcoin surgió un nuevo paradigma tecnológico alrededor del mundo de las criptomonedas (o criptodivisas). Bitcoin fue la primera criptomoneda que se apoyaba en la cadena de bloques, un sistema descentralizado, autónomo y seguro que permite realizar transacciones entre dos individuos en cualquier parte del mundo sin necesidad de intermediarios con total seguridad. Bitcoin fue el pionero, apareciendo más tarde otros tipos de criptomoneda con características diferentes como es el caso de Ethereum. Esta nueva cadena de bloques desarrollada por su creador Vitalik Buterin añadía una nueva funcionalidad nunca vista en una cadena de bloques, los contratos inteligentes. Los contratos inteligentes otorgan a una red de cadena de bloques la inclusión de nuevos tipos de direcciones que pueden funcionar como usuarios de la red con una funcionalidad especifica. El hecho de añadir más variables a la cadena de bloques y que estas sean programables generan de forma natural una serie de potenciales peligros: errores de programación, robos de cuentas (con su correspondiente perdida de dinero), usos malintencionados de contratos, flujos de trabajo erróneos, etc. En definitiva, se abría paso un problema que debe solucionarse de forma efectiva mediante la búsqueda de aquellos errores y fallos (vulnerabilidades) en los contratos inteligentes. Desarrolladores del mundo y la propia fundación de Ethereum se pusieron a crear diferentes tipos de herramientas de análisis de seguridad informática centradas en contratos inteligentes escritos en Solidity, el lenguaje que maneja Ethereum. Los diferentes desarrolladores que quieran hacer uso de cada herramienta deben instalarlas por separado, aprender a usarlas y ejecutar análisis de forma individual, es decir, hacer un proceso de aprendizaje por cada herramienta nueva, lo cual, en tiempo y recursos es realmente alto. Aquí es donde surge el uso de la herramienta desarrollada como parte del trabajo de fin de grado, proporcionando un estudio completo de la mayor parte de las herramientas actualmente existentes, creando una herramienta tanto por línea de comandos para el análisis masivo de contratos ya desplegados en la cadena de bloques de Ethereum como el análisis de contratos locales. La herramienta provee una forma sencilla de realizar estudios para conocer cuál es el estado actual de la red como para analizar un contrato que quiera ser desplegado teniendo todos los recursos unificados.
Bitcoin was born in 2008 creating a new concept around cryptocurrencies world. Bitcoin was the first cryptocurrency which is supported by Blockchain. It is a decentralized, autonomous and secure system giving the possibility to make transactions between two individuals in any part of the world without an intermediate government. Bitcoin was the genesis and after that new cryptocurrencies with some new features appeared. One of them was Ethereum, created by Vitalik Buterin, which added a new functionality never saw in a public Blockchain at that time called smarts contracts. Smart contracts gives a new address types which works as Blockchain users with a specific function. The facts to add new programmable variables to Blockchain generates new potential errors because of his nature: bugs, stolen accounts (and corresponding money loss), bad contract uses, wrong workflows, etc. Summarizing, this generates new issues that have to be resolved effectively. Developers around the world and Ethereum foundation started to create security tools to make new Solidity smart contracts secures. Different Solidity developers who want to use this kind of tools has to install each one separately, learn how to use them and execute each tool with each contract. This consumes a lot of time, resources, and effectiveness, so the main thing here was to create a unique tool which put together every security tool mentioned before into one single point. This tool could work in both cases such as command line or a visual interface. Command line is though to analyse existing contract already deployed in Ethereum Blockchain and visual interface to analyse local contracts.
Bitcoin was born in 2008 creating a new concept around cryptocurrencies world. Bitcoin was the first cryptocurrency which is supported by Blockchain. It is a decentralized, autonomous and secure system giving the possibility to make transactions between two individuals in any part of the world without an intermediate government. Bitcoin was the genesis and after that new cryptocurrencies with some new features appeared. One of them was Ethereum, created by Vitalik Buterin, which added a new functionality never saw in a public Blockchain at that time called smarts contracts. Smart contracts gives a new address types which works as Blockchain users with a specific function. The facts to add new programmable variables to Blockchain generates new potential errors because of his nature: bugs, stolen accounts (and corresponding money loss), bad contract uses, wrong workflows, etc. Summarizing, this generates new issues that have to be resolved effectively. Developers around the world and Ethereum foundation started to create security tools to make new Solidity smart contracts secures. Different Solidity developers who want to use this kind of tools has to install each one separately, learn how to use them and execute each tool with each contract. This consumes a lot of time, resources, and effectiveness, so the main thing here was to create a unique tool which put together every security tool mentioned before into one single point. This tool could work in both cases such as command line or a visual interface. Command line is though to analyse existing contract already deployed in Ethereum Blockchain and visual interface to analyse local contracts.
Description
Trabajo Fin de Grado en Ingeniería Informática, Facultad de Informática UCM, Departamento de Ingeniería del Software e Inteligencia Artificial, Curso 2019/2020.