Security of Smart Contracts Written in the Solidity Programming Language

Coding smart contracts in the Solidity programming language presents a particular challenge, as the specific characteristics of blockchain technology require the use of unconventional programming patterns. Potential programming bugs and security vulnerabilities written in the programme code are visible to everyone, as the source code of smart contracts is public. From the perspective of smart contract security, it is therefore advisable for the programmer to have a good knowledge of established design patterns that enable the writing of functional programme code with a reduced possibility of making errors. For each described vulnerability, in addition to a concrete example, we also provide recommendations on how to avoid or at least reduce these vulnerabilities. Where this was possible, concrete examples written in programme code were provided, showing an example of vulnerable programme code and an example where this vulnerability was eliminated.

Problem

Coding smart contracts in the Solidity programming language presents a particular challenge, as the specific characteristics of blockchain technology require the use of unconventional programming patterns. Potential programming bugs and security vulnerabilities written in the programme code are visible to everyone, as the source code of smart contracts is public.

Solution and Method

From the perspective of smart contract security, it is therefore advisable for the programmer to have a good knowledge of established design patterns that enable the writing of functional programme code with a reduced possibility of making errors. In the diploma thesis, we examine the difference between various types of distributed consensus algorithms and present the basic building blocks of blockchains. By citing concrete examples of blockchain use in real business situations, we wanted to dispel the notion that smart contracts are only useful in the field of financial transactions.

In the continuation of the diploma thesis, we deal with the special characteristics of the Solidity programming language, defining its advantages and disadvantages. As one of the major disadvantages of the Solidity programming language, we can certainly emphasise its youth and the associated relatively large number of security vulnerabilities and frequent changes and upgrades to the programme code. For this reason, we present the largest and most common vulnerabilities of smart contracts written in Solidity.

Results

For each described vulnerability, in addition to a concrete example, we also provide recommendations on how to avoid or at least reduce these vulnerabilities. Where this was possible, concrete examples written in programme code were provided, showing an example of vulnerable programme code and an example where this vulnerability was eliminated. Based on the provided vulnerabilities and recommendations, a checklist was prepared and included in the diploma thesis, which could serve programmers in the future as a quick reference in their work.

The checklist was designed so that for each vulnerability, the area to which it relates was indicated, as well as a brief statement regarding recommended and discouraged practices. In this way, we wanted to further simplify the use of the checklist for programmers. The acquired knowledge was then incorporated into writing our own example application, namely an NFT token marketplace, which enables the user to connect the application with a wallet and sell tokens.

The application consists of two smart contracts and a simple graphical user interface written in JavaScript.