SmartDec is presenting a smart contract vulnerability classification system to educate developers around the world.

1. Smart contract
vulnerability
classification
#blockchainhackers, Prague, 29.10.2018
Evgeny
Marchenko
Ivan
Ivanitskiy
SmartDec
Lead Developer
marchenko@smartdec.net
SmartDec
Chief Analytics Officer
ivanitskiy@smartdec.net
Twitter: @IvanIvanitskiy

2. • static code analysis
• smart contracts audits (>100)
• smart contracts development
SmartCheck: tool.smartdec.net
Blog: blog.smartdec.net
Website: smartdec.net
Twitter: @SmartDecTeam
SmartDec
#blockchainhackers, Prague, 29.10.2018

3. A code issue:
• To fix or not to fix?
• Bug or vulnerability?
• Severity?
• Name?
Problem
Thus, we needed standardization!
#blockchainhackers, Prague, 29.10.2018

4. • no hierarchy
• no explanation
• items of different nature
• items of different frequency
Standardization
So, it’s not enough!
#blockchainhackers, Prague, 29.10.2018

5. o to work with:
• issues
• hacks
• tools rules
o to educate developers
o to improve audit experience
o to compare standardizations
What do we need?
So, we need classification!
#blockchainhackers, Prague, 29.10.2018

6. • classifies
• is self-explanatory
• gives high-level
understanding
Good classification
So we made our classification!
#blockchainhackers, Prague, 29.10.2018

7. Classification structureclassification
class
(nature)
type
group
(feature)
issues
#blockchainhackers, Prague, 29.10.2018

8. Classes
blockchain
language
model
#blockchainhackers, Prague, 29.10.2018

9. Classes
blockchain
language
model
…?
#blockchainhackers, Prague, 29.10.2018

10. Class: blockchain
contract
interaction
block content
manipulation
message
structure
gas
limitations
#blockchainhackers, Prague, 29.10.2018
ether
transfer

11. Class: blockchain
contract
interaction
reentrancy
(SWC-107)
The DAO
block content
manipulation
front-running
ERC20
approve()
message
structure
gas
limitations
#blockchainhackers, Prague, 29.10.2018
ether
transfer

12. Class: language
storage access
uninitialized storage
pointer (SWC-109)
internal control
flow
arithmetic
over/underflow
(SWC-101)
batchTransfer()
#blockchainhackers, Prague, 29.10.2018

13. Class: model
trust
overpowered
owner
KickICO
privacyauthorization
constructor
name
Rubixi
#blockchainhackers, Prague, 29.10.2018
economy

14. Is it good?
 classifies
 is self-explanatory
 gives high-level understanding
Help us!
• use it
• comment
• commit
github.com/smartdec/classification
#blockchainhackers, Prague, 29.10.2018

15. Classification of
smart contracts
vulnerabilities
Evgeny
Marchenko
Ivan
Ivanitskiy
SmartDec
Lead Developer
marchenko@smartdec.net
SmartDec
Chief Analytics Officer
ivanitskiy@smartdec.net
Twitter: @IvanIvanitskiy
#blockchainhackers, Prague, 29.10.2018