Publication Type
Conference Proceeding Article
Version
publishedVersion
Publication Date
3-2023
Abstract
Due to the open-source nature of the blockchain ecosystem, it is common for new blockchains to fork or partially reuse the code of classic blockchains. For example, the popular Dogecoin, Litecoin, Binance BSC, and Polygon are all variants of Bitcoin/Ethereum. These “forked” blockchains thus could encounter similar vulnerabilities that are propagated from Bitcoin/Ethereum during forking or subsequently commit fetching. In this paper, we conduct a systematic study of detecting and investigating the propagated vulnerabilities in forked blockchain projects. To facilitate this study, we propose BlockScope, a novel tool that can effectively and efficiently detect multiple types of cloned vulnerabilities given an input of existing Bitcoin/Ethereum security patches. Specifically, BlockScope adopts similarity-based code match and designs a new way of calculating code similarity to cover all the syntax-wide variant (i.e., Type-1, Type-2, and Type-3) clones. Moreover, BlockScope automatically extracts and leverages the contexts of patch code to narrow down the search scope and locate only potentially relevant code for comparison.Our evaluation shows that BlockScope achieves good precision and high recall both at 91.8% (1.8 times higher recall than that in the state-of-the-art ReDeBug while with close precision). BlockScope allows us to discover 101 previously unknown vulnerabilities in 13 out of the 16 forked projects of Bitcoin and Ethereum, including 16 from Dogecoin, 6 from Litecoin, 1 from Binance BSC, and 4 from Optimism. We have reported all the vulnerabilities to their developers; 40 of them have been patched or accepted, 66 were acknowledged or under pending, and only 4 were rejected. We further investigate the propagation and patching processes of discovered vulnerabilities, and reveal three types of vulnerability propagation from source to forked projects, as well as the long delay (mostly over 200 days) for releasing patches in Bitcoin forks (vs. ∼100 days for Ethereum forks).
Discipline
Software Engineering
Research Areas
Software and Cyber-Physical Systems
Publication
Network and Distributed System Security Symposium (NDSS) 2023: San Diego, February 27 - March 3
First Page
1
Last Page
16
ISBN
1891562835
Identifier
10.14722/ndss.2023.24222
Publisher
Internet Society
City or Country
San Diego
Citation
YI, Xiao; FANG, Yuzhou; WU, Daoyuan; and JIANG, Lingxiao.
BlockScope: Detecting and investigating propagated vulnerabilities in forked blockchain projects. (2023). Network and Distributed System Security Symposium (NDSS) 2023: San Diego, February 27 - March 3. 1-16.
Available at: https://ink.library.smu.edu.sg/sis_research/7818
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Additional URL
https://doi.org/10.14722/ndss.2023.24222