SolGuard: Preventing external call issues in smart contract-based multi-agent robotic systems

Purathani Praitheeshan, Lei Pan, Xi Zheng, Alireza Jolfaei, Robin Doss

Research output: Contribution to journalArticlepeer-review

Abstract

In the new era of blockchain-based multi-agent robotic systems, smart contract programs perform an influential role in implementing decentralized applications with required task allocations. Smart contract programs are developed using script-type of programming languages, and they have already deployed several vulnerable patterns without proper testing and audit. We studied Solidity smart contracts running on the Ethereum platform and identified that they had been exploited because of several programming issues, especially using low-level external calls to malicious sources. Since smart contracts are immutable after their deployment to autonomous multi-robot systems, they should be tested to fix possible development phase issues. We implemented a prototype plugin called SolGuard by extending the solhint linter to prevent three critical issues related to Solidity smart contract programs’ usage of external calls. The SolGuard plugin checks state variable order in the smart contracts, participation of delegatecall invocations, address type parameters in the smart contract's constructor, and denial of service patterns. We empirically evaluate the SolGuard plugin with existing popular static analysis tools. Our results indicate that SolGuard outperformed the baseline tools in terms of efficiency and accuracy.

Original languageEnglish
Pages (from-to)150-166
Number of pages17
JournalInformation Sciences
Volume579
DOIs
Publication statusPublished - Nov 2021
Externally publishedYes

Keywords

  • Blockchain-based autonomous robotics systems
  • External call
  • Security vulnerabilities
  • Smart contract
  • Solidity

Fingerprint

Dive into the research topics of 'SolGuard: Preventing external call issues in smart contract-based multi-agent robotic systems'. Together they form a unique fingerprint.

Cite this