Department of Business and Economics Sciences, University of Cagliari, Viale Fra Ignazio 17, Cagliari, Italy.
Department of Computer Science and Mathematics, University of Cagliari, Via Porcell 4, Cagliari, Italy.
Sci Rep. 2024 Oct 8;14(1):23433. doi: 10.1038/s41598-024-73454-0.
The expansion of smart contracts on the Ethereum blockchain has created a diverse ecosystem of decentralized applications. This growth, however, poses challenges in classifying and securing these contracts. Existing research often separately addresses either classification or vulnerability detection, without a comprehensive analysis of how contract types are related to security risks. Our study addresses this gap by developing a taxonomy of smart contracts and examining the potential vulnerabilities associated with each category. We use the Latent Dirichlet Allocation (LDA) model to analyze a dataset of over 100,040 Ethereum smart contracts, which is notably larger than those used in previous studies. Our analysis categorizes these contracts into eleven groups, with five primary categories: Notary, Token, Game, Financial, and Blockchain interaction. This categorization sheds light on the various functions and applications of smart contracts in today's blockchain environment. In response to the growing need for better security in smart contract development, we also investigate the link between these categories and common vulnerabilities. Our results identify specific vulnerabilities associated with different contract types, providing valuable insights for developers and auditors. This relationship between contract categories and vulnerabilities is a new contribution to the field, as it has not been thoroughly explored in previous research. Our findings offer a detailed taxonomy of smart contracts and practical recommendations for enhancing security. By understanding how contract categories correlate with vulnerabilities, developers can implement more effective security measures, and auditors can better prioritize their reviews. This study advances both academic knowledge of smart contracts and practical strategies for securing decentralized applications on the Ethereum platform.
以太坊区块链上智能合约的扩展创造了一个多样化的去中心化应用生态系统。然而，这种增长给这些合约的分类和安全带来了挑战。现有研究往往分别解决分类或漏洞检测问题，而没有全面分析合约类型与安全风险之间的关系。我们的研究通过开发智能合约分类法并检查每个类别相关的潜在漏洞来解决这一差距。我们使用潜在狄利克雷分配（LDA）模型分析了超过 100040 个以太坊智能合约的数据集，这明显大于以前研究中使用的数据集。我们的分析将这些合约分为十一个组，其中五个主要类别为：公证人、代币、游戏、金融和区块链交互。这种分类揭示了智能合约在当今区块链环境中的各种功能和应用。为了应对智能合约开发中对更好安全性的日益增长的需求，我们还研究了这些类别与常见漏洞之间的联系。我们的结果确定了与不同合约类型相关的特定漏洞，为开发人员和审核员提供了有价值的见解。这种合约类别和漏洞之间的关系是该领域的一个新贡献，因为在以前的研究中没有对此进行深入探讨。我们的发现提供了智能合约的详细分类法，并为增强安全性提供了实际建议。通过了解合约类别与漏洞之间的相关性，开发人员可以实施更有效的安全措施，审核员可以更好地确定审核优先级。这项研究推进了以太坊平台上智能合约的学术知识和保护去中心化应用的实际策略。
