ContractSafeguard: Practical Bug Bounty Platform for Smart Contracts with Intel SGX

Bug bounties are a helpful system for identifying vulnerabilities in smart contracts. Many web3 applications use bug bounties today. However, hackers might worry about not getting paid or receiving a reduced bounty if the bounty is not exchanged atomically with a bug report. This concern could lead hackers to exploit the identified bug instead of reporting it. Furthermore, other efforts related to bug bounties require modification of existing smart contracts. To solve this, we propose a practical bug bounty platform for smart contracts, ContractSafeguard, that utilizes Intel SGX to ensure the existence of bugs and atomic exchange of bounty and bug reports. Bug hunters send transactions to smart contracts hosted within the Enclave and glitch them. Test code within the Enclave generates a bug report that includes proof of the bug’s existence and a method that triggers the bug. In other words, within the Enclave, our mechanism detects and proves that the smart contract under test has entered an abnormal state. Our on-chain bug bounty contract then verifies the proof within the bug report and pays the bounty to the bug hunter atomically. Since the proof is produced within the Enclave, generating false proofs is impossible, and the on-chain contract can trust the report. Additionally, the developer can use existing smart contracts without modification since we have a runtime of smart contracts in the Enclave. We design ContractSafeguard for Ethereum smart contracts.