Analyzing and detecting four types of critical security vulnerabilities in move smart contracts

Analyzing and detecting four types of critical security vulnerabilities in move smart contracts

연구 분야: Strategies

학회: Cluster Computing

Move is a new programming language for smart contracts, known for making security its primary goal. However, several recent studies, reports, and other relevant materials have identified potential security concerns associated with Move. In this paper, we systematically collect and analyze a range of audit reports, blog posts, and bounty challenges related to Move. Through this analysis, we identify four types of vulnerabilities that have the potential to cause significant financial losses but have not been adequately addressed or explored in prior studies. For instance, one of the identified vulnerabilities enables attackers to gain the ability to issue tokens. To assist developers in understanding and mitigating these vulnerabilities, this paper provides a detailed description, illustrative examples, potential impacts, and mitigation recommendations for each vulnerability. Furthermore, to enable automated detection, we developed four new detectors based on MoveScan, the most advanced analysis framework for Move smart contracts. Using these four detectors, we identify up to 20,778 vulnerabilities across 37,302 contracts deployed on the Aptos and Sui, two of the most popular blockchains using Move. Through manual inspection, we find that our detectors achieve an overall precision rate of 98.82% and uncover real, impactful vulnerabilities. We performed formal verification of two vulnerabilities using Move Prover. Compared to the vulnerabilities identified by MoveScan, Move Prover achieved a relative recall rate of 78.95%. The novel findings presented in this paper offer valuable insights that empower developers to effectively detect and prevent these vulnerabilities using our proposed detectors, thereby contributing to the future improvement of Move contract security.