Smart Contract Security Testing Guide
Exploits and attacks have always been common in the world of decentralized applications due to vulnerabilities in smart contracts, which can be seen from various sources such as:
- https://rekt.news/
- https://defiyield.app/rekt-database
Unlike traditional software, which can be easily patched, most smart contracts cannot be modified after deployment, allowing the logic of smart contracts to be modified after deployment may open up opportunities for attacks by external and internal actors. Therefore, security is a priority, if not the most important, in the development of smart contracts.
It is important for smart contract developers to know how to implement smart contracts safely, and to test for common pitfalls and risks. For security professionals, having a clear checklist can help standardize testing methods and prevent common risks from being overlooked. For these reasons, the Smart Contract Security Testing Guidelines (SCSTG) came into being.
SCSTG is a risk-based guide for smart contract security professionals and developers to refer to when conducting smart contract security testing. Introduce the characteristics and verification process of different types of smart contract security issues, and give examples of vulnerable contracts or functions, as well as solutions to solve or reduce risks from the root causes.
Risks are grouped into the following 9 categories:
- Architecture and Design
Implementing secure smart contracts requires proper architecture and design. This testing category involves the use of the compiler, the design of the smart contract calling architecture, and the design of roles and permissions.
- Access control
Access control enforces policy by preventing users from exceeding their authorized permissions. Improper access controls can lead to unauthorized disclosure of information, manipulation or loss of data, or performance of business functions beyond the user's capabilities.
- Error Handling and Logging
Error handling and logging are the key to making errors in smart contracts traceable, guiding the execution process to the correct path based on the execution results, letting users know where and how the contract failed, and being able to track past operations completed on the smart contract .
- Business logic
Business logic flow should generally be continuous, processed in order, and cannot be bypassed. Business logic vulnerabilities can occur when a smart contract's legitimate processing flow is used in a way that could adversely affect the user or the owner of the smart contract.
- blockchain data
Data on the blockchain should be used properly (including storage, retrieval, and modification) to preserve data integrity (and sometimes confidentiality). This includes the risk of on-chain data manipulation, such as price manipulation using flash loans.
- external components
Smart contracts can be interconnected by inheriting previously developed smart contracts or calling functions of other contracts. If not done properly, the use of unsafe external components may cause unwanted or harmful effects, such as reentrancy attacks.
- arithmetic
Mathematical operations may work differently on different programming languages and platforms. Arithmetic operations performed in smart contracts should be able to safely handle all ranges of possible values.
- denial of service
Incorrect contract logic can affect the usability of the contract. It should be ensured that smart contracts can function properly as designed without interference from internal or external factors.
- Best Practices
Smart contracts can be implemented in a variety of ways, depending on each developer's style. However, following best practices can improve the code quality of smart contracts, making them cleaner, more readable, or more efficient.
The complete Smart Contract Security Testing Guide (SCSTG) can be viewed here: https://inspex.gitbook.io/testing-guide
Source：https://medium.com/@inspexco/introducing-smart-contract-security-testing-guide-3905adf447de
about
ChinaDeFi - ChinaDeFi.com is a research-driven DeFi innovation organization, and we are also a blockchain development team. Every day, from nearly 900 pieces of content from more than 500 high-quality information sources around the world, we look for content that is more in-depth and systematic, and synchronizes to the Chinese market at the fastest speed to provide decision-making auxiliary materials.
Layer 2 Daoist Friends - Welcome blockchain technology enthusiasts and research analysts who are interested in Layer 2 to contact Gavin (WeChat: chinadefi) to discuss the landing opportunities brought by Layer 2. Please pay attention to our WeChat public account "Decentralized Financial Community" .