An Empirical Study of Blockchain System Vulnerabilities: Modules, Types, and Patterns
Blockchain, as a distributed ledger technology, becomes increasingly popular, especially for enabling valuable cryptocurrencies and smart contracts. However, the blockchain software systems inevitably have many bugs. Although bugs in smart contracts have been extensively investigated, security bugs of the underlying blockchain systems are much less explored. In this paper, we conduct an empirical study on blockchain’s system vulnerabilities from four representative blockchains, Bitcoin, Ethereum, Monero, and Stellar. Specifically, we first design a systematic filtering process to effectively identify 1,037 vulnerabilities and their 2,317 patches from 34,245 issues/PRs (pull requests) and 85,164 commits on GitHub. We thus build the first blockchain vulnerability dataset, which is available at https://github.com/VPRLab/BlkVulnDataset. We then perform unique analyses of this dataset at three levels, including (i) file-level vulnerable module categorization by identifying and correlating module paths across projects, (ii) text-level vulnerability type clustering by natural language processing and similarity-based sentence clustering, and (iii) code-level vulnerability pattern analysis by generating and clustering code change signatures that capture both syntactic and semantic information of patch code fragments.
Our analyses reveal three key findings: (i) some blockchain modules are more susceptible than the others; notably, each of the modules related to consensus, wallet, and networking has over 200 issues; (ii) about 70% of blockchain vulnerabilities are of traditional types, but we also identify four new types specific to blockchains; and (iii) we obtain 21 blockchain-specific vulnerability patterns that capture unique blockchain attributes and statuses, and demonstrate that they can be used to detect similar vulnerabilities in other popular blockchains, such as Dogecoin, Bitcoin SV, and Zcash.
Wed 16 NovDisplayed time zone: Beijing, Chongqing, Hong Kong, Urumqi change
11:00 - 12:30
|An Exploratory Study on the Predominant Programming Paradigms in Python Code
Research PapersDOI Pre-print Media Attached
|An Empirical Study of Blockchain System Vulnerabilities: Modules, Types, and Patterns
Xiao Yi Chinese University of Hong Kong, Daoyuan Wu Chinese University of Hong Kong, Lingxiao Jiang Singapore Management University, Yuzhou Fang Chinese University of Hong Kong, Kehuan Zhang Chinese University of Hong Kong, Wei Zhang Nanjing University of Posts and TelecommunicationsDOI
|How to Better Utilize Code Graphs in Semantic Code Search?
Yucen Shi Northeastern University, Ying Yin Northeastern University, Zhengkui Wang Singapore Institute of Technology, David Lo Singapore Management University, Tao Zhang Macau University of Science and Technology, Xin Xia Huawei, Yuhai Zhao Northeastern University, Bowen Xu Singapore Management UniversityDOI
|23 Shades of Self-Admitted Technical Debt: An Empirical Study on Machine Learning Software
David OBrien Iowa State University, Sumon Biswas Carnegie Mellon University, Sayem Mohammad Imtiaz Iowa State University, Rabe Abdalkareem Carleton University, Emad Shihab Concordia University, Hridesh Rajan Iowa State UniversityDOI
|WikiDoMiner: Wikipedia Domain-specific Miner
|RegMiner: Mining Replicable Regression Dataset from Code Repositories
Xuezhi Song Fudan University, Yun Lin Shanghai Jiao Tong University; National University of Singapore, Yijian Wu Fudan University, Yifan Zhang National University of Singapore, Siang Hwee Ng National University of Singapore, Xin Peng Fudan University, Jin Song Dong National University of Singapore, Hong Mei Peking University