Abstract: Smart contracts on blockchain operate on quantity of digital assets. Once deployed on blockchain, they are difficult to modify. Therefore, the analysis and detection of security vulnerabilities of smart contracts has become an important research topic. Smartcheck is a static analysis tool for Ethereum smart contracts that converts Solidity source code into an XML-based intermediate representation and checks it against XPath patterns. While Smartcheck can analyze most of the vulnerabilities, it has limitations in terms of coverage and accuracy. To address these issues, we developed a new tool, SmartETH, to further improve Smartcheck by analyzing typical vulnerabilities such as timestamp dependency, integer overflow and delegatecall vulnerabilities. The improved Smartcheck is tested on a large dataset and verified by five specific contracts, demonstrating improved accuracy in vulnerability detection. In addition, improvements have reduced false positives and missed positives for many vulnerabilities.

Key words: smart contract, security vulnerability, Smartcheck, Ethereum, blockchain