English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Smart contracts are programs deployed on a blockchain and are immutable oncedeployed. Reentrancy, one of the most important vulnerabilities in smartcontracts, has caused millions of dollars in financial loss. Many reentrancydetection approaches have been proposed. It is necessary to investigate theperformance of these approaches to provide useful guidelines for theirapplication. In this work, we conduct a large-scale empirical study on thecapability of five well-known or recent reentrancy detection tools such asMythril and Sailfish. We collect 230,548 verified smart contracts fromEtherscan and use detection tools to analyze 139,424 contracts afterdeduplication, which results in 21,212 contracts with reentrancy issues. Then,we manually examine the defective functions located by the tools in thecontracts. From the examination results, we obtain 34 true positive contractswith reentrancy and 21,178 false positive contracts without reentrancy. We alsoanalyze the causes of the true and false positives. Finally, we evaluate thetools based on the two kinds of contracts. The results show that more than99.8% of the reentrant contracts detected by the tools are false positives witheight types of causes, and the tools can only detect the reentrancy issuescaused by call.value(), 58.8% of which can be revealed by the Ethereum'sofficial IDE, Remix. Furthermore, we collect real-world reentrancy attacksreported in the past two years and find that the tools fail to find any issuesin the corresponding contracts. Based on the findings, existing works onreentrancy detection appear to have very limited capability, and researchersshould turn the rudder to discover and detect new reentrancy patterns exceptthose related to call.value().

Turn the Rudder: A Beacon of Reentrancy Detection for Smart Contracts on Ethereum