SIF: A Framework for Solidity Contract Instrumentation and Analysis

Solidity is an object-oriented and high-level language for writing smart contracts that are used to execute, verify and enforce credible transactions on permissionless blockchains. In the last few years, analysis of smart contracts has raised considerable interest and numerous techniques have been proposed to check the presence of vulnerabilities in them. Current techniques lack traceability in source code and have widely differing work flows. There is no single unifying framework for analysis, instrumentation, optimisation and code generation of Solidity contracts at the source code level. In this paper, we present SIF, a comprehensive framework for Solidity contract analysis, query, instrumentation, and code generation. SIF provides support for Solidity contract developers and testers to build source level techniques for analysis, understanding, diagnostics, optimisations and code generation. We show feasibility and applicability of the framework by building practical tools on top of it and running them on 1838 real smart contracts deployed on the Ethereum network.

I. Introduction

Blockchains are the underlying technology for making online secure transactions using cryptocurrencies such as Bitcoins and Ethers. Executing, verifying and enforcing credible transactions on blockchains is done using smart contracts, which is code written by the buyer and seller using Turing-complete languages [1]. Solidity is a popular object-oriented and high-level language for writing smart contracts [2], [3] and can be compiled to bytecode for execution on the blockchain network. With the increased use of smart contracts across application domains, there is a crucial need for a unified framework that supports and facilitates Solidity code analysis, understanding, transformation, and development of tools for verification and testing that provide strong security guarantees.