WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection

Bo Jiang; Yifei Chen; Dong Wang; Imran Ashraf; W.K. Chan

doi:10.1109/QRS54544.2021.00102

WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection

Bo Jiang^*
, Yifei Chen
, Dong Wang
, Imran Ashraf
, W.K. Chan

^*Corresponding author for this work

Department of Computer Science

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

28 Citations (Scopus)

Abstract

Many popular blockchain platforms support smart contracts for building decentralized applications. However, the vulnerabilities within smart contracts have demonstrated to lead to serious financial loss to their end users. In particular, the smart contracts on EOSIO smart contract platform have resulted in the loss of around 380K EOS tokens, which was around 1.9 million worth of USD at the time of attack. The EOSIO smart contract platform is based on the Wasm VM, which is also the underlying system supporting other smart contract platforms as well as Web application. In this work, we present WANA, an extensible smart contract vulnerability detection tool based on the symbolic execution for Wasm bytecode. WANA proposes a set of algorithms to detect the vulnerabilities in EOSIO smart contracts based on Wasm bytecode analysis. Our experimental analysis shows that WANA can effectively and efficiently detect vulnerabilities in EOSIO smart contracts. Furthermore, our case study also demonstrates that WANA can be extended to effectively detect vulnerabilities in Ethereum smart contracts.

Original language	English
Title of host publication	PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021
Publisher	IEEE
Pages	926-937
ISBN (Electronic)	978-1-6654-5813-9
ISBN (Print)	978-1-6654-5814-6
DOIs	https://doi.org/10.1109/QRS54544.2021.00102
Publication status	Published - Dec 2021
Event	21st IEEE International Conference on Software Quality, Reliability, and Security (QRS 2021) - Hybrid, Hainan Island, China Duration: 6 Dec 2021 → 10 Dec 2021 https://qrs21.techconf.org/

Publication series

Name	IEEE International Conference on Software Quality Reliability and Security
ISSN (Print)	2693-9185
ISSN (Electronic)	2693-9177

Conference

Conference	21st IEEE International Conference on Software Quality, Reliability, and Security (QRS 2021)
Place	China
City	Hainan Island
Period	6/12/21 → 10/12/21
Internet address	https://qrs21.techconf.org/

Research Keywords

WASM bytecode
Symbolic Execution
Smart Contract
Vulnerability Detection

Access Output

10.1109/QRS54544.2021.00102

Other Access Options

Check CityUHK Library

Permanent Link

Right click to copy link

Cite this

Jiang, B., Chen, Y., Wang, D., Ashraf, I., & Chan, W. K. (2021). WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection. In PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021 (pp. 926-937). (IEEE International Conference on Software Quality Reliability and Security). IEEE. https://doi.org/10.1109/QRS54544.2021.00102

@inproceedings{3138fec278734a17b808cbe4b78704ea,

title = "WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection",

abstract = "Many popular blockchain platforms support smart contracts for building decentralized applications. However, the vulnerabilities within smart contracts have demonstrated to lead to serious financial loss to their end users. In particular, the smart contracts on EOSIO smart contract platform have resulted in the loss of around 380K EOS tokens, which was around 1.9 million worth of USD at the time of attack. The EOSIO smart contract platform is based on the Wasm VM, which is also the underlying system supporting other smart contract platforms as well as Web application. In this work, we present WANA, an extensible smart contract vulnerability detection tool based on the symbolic execution for Wasm bytecode. WANA proposes a set of algorithms to detect the vulnerabilities in EOSIO smart contracts based on Wasm bytecode analysis. Our experimental analysis shows that WANA can effectively and efficiently detect vulnerabilities in EOSIO smart contracts. Furthermore, our case study also demonstrates that WANA can be extended to effectively detect vulnerabilities in Ethereum smart contracts.",

keywords = "WASM bytecode, Symbolic Execution, Smart Contract, Vulnerability Detection",

author = "Bo Jiang and Yifei Chen and Dong Wang and Imran Ashraf and W.K. Chan",

year = "2021",

month = dec,

doi = "10.1109/QRS54544.2021.00102",

language = "English",

isbn = "978-1-6654-5814-6",

series = "IEEE International Conference on Software Quality Reliability and Security",

publisher = "IEEE",

pages = "926--937",

booktitle = "PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021",

address = "United States",

note = "21st IEEE International Conference on Software Quality, Reliability, and Security (QRS 2021) ; Conference date: 06-12-2021 Through 10-12-2021",

url = "https://qrs21.techconf.org/",

}

Jiang, B, Chen, Y, Wang, D, Ashraf, I & Chan, WK 2021, WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection. in PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021. IEEE International Conference on Software Quality Reliability and Security, IEEE, pp. 926-937, 21st IEEE International Conference on Software Quality, Reliability, and Security (QRS 2021), Hainan Island, China, 6/12/21. https://doi.org/10.1109/QRS54544.2021.00102

WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection. / Jiang, Bo; Chen, Yifei; Wang, Dong et al.
PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021. IEEE, 2021. p. 926-937 (IEEE International Conference on Software Quality Reliability and Security).

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

TY - GEN

T1 - WANA

T2 - 21st IEEE International Conference on Software Quality, Reliability, and Security (QRS 2021)

AU - Jiang, Bo

AU - Chen, Yifei

AU - Wang, Dong

AU - Ashraf, Imran

AU - Chan, W.K.

PY - 2021/12

Y1 - 2021/12

N2 - Many popular blockchain platforms support smart contracts for building decentralized applications. However, the vulnerabilities within smart contracts have demonstrated to lead to serious financial loss to their end users. In particular, the smart contracts on EOSIO smart contract platform have resulted in the loss of around 380K EOS tokens, which was around 1.9 million worth of USD at the time of attack. The EOSIO smart contract platform is based on the Wasm VM, which is also the underlying system supporting other smart contract platforms as well as Web application. In this work, we present WANA, an extensible smart contract vulnerability detection tool based on the symbolic execution for Wasm bytecode. WANA proposes a set of algorithms to detect the vulnerabilities in EOSIO smart contracts based on Wasm bytecode analysis. Our experimental analysis shows that WANA can effectively and efficiently detect vulnerabilities in EOSIO smart contracts. Furthermore, our case study also demonstrates that WANA can be extended to effectively detect vulnerabilities in Ethereum smart contracts.

AB - Many popular blockchain platforms support smart contracts for building decentralized applications. However, the vulnerabilities within smart contracts have demonstrated to lead to serious financial loss to their end users. In particular, the smart contracts on EOSIO smart contract platform have resulted in the loss of around 380K EOS tokens, which was around 1.9 million worth of USD at the time of attack. The EOSIO smart contract platform is based on the Wasm VM, which is also the underlying system supporting other smart contract platforms as well as Web application. In this work, we present WANA, an extensible smart contract vulnerability detection tool based on the symbolic execution for Wasm bytecode. WANA proposes a set of algorithms to detect the vulnerabilities in EOSIO smart contracts based on Wasm bytecode analysis. Our experimental analysis shows that WANA can effectively and efficiently detect vulnerabilities in EOSIO smart contracts. Furthermore, our case study also demonstrates that WANA can be extended to effectively detect vulnerabilities in Ethereum smart contracts.

KW - WASM bytecode

KW - Symbolic Execution

KW - Smart Contract

KW - Vulnerability Detection

UR - http://gateway.isiknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcAuth=LinksAMR&SrcApp=PARTNER_APP&DestLinkType=FullRecord&DestApp=WOS&KeyUT=000814747000092

U2 - 10.1109/QRS54544.2021.00102

DO - 10.1109/QRS54544.2021.00102

M3 - RGC 32 - Refereed conference paper (with host publication)

SN - 978-1-6654-5814-6

T3 - IEEE International Conference on Software Quality Reliability and Security

SP - 926

EP - 937

BT - PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021

PB - IEEE

Y2 - 6 December 2021 through 10 December 2021

ER -

Jiang B, Chen Y, Wang D, Ashraf I , Chan WK. WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection. In PROCEEDINGS - 2021 21st International Conference on Software Quality, Reliability and Security - QRS 2021. IEEE. 2021. p. 926-937. (IEEE International Conference on Software Quality Reliability and Security). doi: 10.1109/QRS54544.2021.00102

WANA: Symbolic Execution of Wasm Bytecode for Extensible Smart Contract Vulnerability Detection

Abstract

Publication series

Conference

Research Keywords

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

Cite this