OpenCyber Academy
Doctoral research · Chapter 2 · English
Course code: OCA-193Chapter 02: OCA-193-C002

Chapter 2 — Web3, blockchain and cryptoasset security: research frontier

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Foundations"]
  N2["2.2 Weakness research"]
  N3["Lab — Tool and manual overlap"]
  N4["2.4 Reading the overlap"]
  N5["2.5 The gap"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Foundations"]
  N2["2.2 Weakness research"]
  N3["Lab — Tool and manual overlap"]
  N4["2.4 Reading the overlap"]
  N5["2.5 The gap"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Foundations]
    |
    v
[2.2 Weakness research]
    |
    v
[Lab — Tool and manual overlap]
    |
    v
[2.4 Reading the overlap]
    |
    v
[2.5 The gap]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) map the research on smart-contract weaknesses and analysis; (2) compare automated and manual review evidence; (3) locate the gap the thesis addresses.

2.1 Foundations

Lucía begins with the systems themselves. Nakamoto's Bitcoin paper describes a ledger secured by proof of work, where history becomes harder to change as blocks accumulate. Wood's Ethereum yellow paper formally specifies a virtual machine that runs contract code, with gas limiting computation. NIST IR 8202 by Yaga and colleagues gives a neutral overview of blockchain components, consensus models and limitations. These sources explain why contract flaws matter so much: deployed code is hard to change and often controls value directly.

2.2 Weakness research

Atzei, Bartoletti and Cimoli (2017) surveyed attacks on Ethereum contracts and organised them by cause in the language, the virtual machine and the blockchain. Luu and colleagues (2016) built Oyente, a symbolic execution tool, and reported that many deployed contracts showed patterns such as transaction-ordering dependence and mishandled exceptions. The SWC registry catalogues weakness classes, and the EEA EthTrust Security Levels define requirements a reviewer can certify. Lucía reads these defensively, extracting categories and review requirements rather than attack techniques.

Her review checklist takes its categories from these sources, so each checklist item can be traced to a published weakness class.

2.3 Tools and their limits

Durieux and colleagues (2020) ran nine automated analysis tools on tens of thousands of contracts and found low agreement between tools and many false positives. Tsankov and colleagues (2018) presented Securify, which checks compliance and violation patterns. Perez and Livshits (2021) showed that contracts flagged as vulnerable were rarely exploited in practice, a reminder that flags are not harm. Lucía concludes that tools are valuable for coverage but cannot stand alone, and that the human review process itself has been studied far less than tools.

Lab — Tool and manual overlap

"""Overlap between automated-tool and manual-review findings on synthetic contracts (read-only)."""
TOOL = {"C1-access", "C1-call", "C2-arith", "C3-call", "C4-access", "C5-arith", "C6-other", "C7-call"}
MANUAL = {"C1-access", "C2-arith", "C2-logic", "C3-call", "C4-oracle", "C5-logic", "C7-call", "C8-access"}
FALSE_POS = {"C6-other"}

def main():
    both = TOOL & MANUAL
    union = TOOL | MANUAL
    print(f"tool {len(TOOL)}, manual {len(MANUAL)}, both {len(both)}, union {len(union)}")
    print(f"Jaccard {len(both) / len(union):.2f}")
    print("manual only:", ", ".join(sorted(MANUAL - TOOL)))
    print("tool only:", ", ".join(sorted(TOOL - MANUAL)), f"(confirmed false positives: {len(FALSE_POS)})")

if __name__ == "__main__":
    main()

Run with python3 lab_overlap.py. Verified output:

tool 8, manual 8, both 4, union 12
Jaccard 0.33
manual only: C2-logic, C4-oracle, C5-logic, C8-access
tool only: C1-call, C4-access, C5-arith, C6-other (confirmed false positives: 1)

2.4 Reading the overlap

On eight synthetic contracts, the tool reports eight findings and manual reviewers eight, but only four are shared: a Jaccard similarity of 0.33 over twelve distinct findings. Manual review alone finds two business-logic issues, one oracle-dependence issue and one access-control issue. The tool alone reports four, one confirmed false positive. Lucía notes that the manual-only findings concern intent and context, which tools cannot know, supporting her focus on improving structured human review rather than replacing it. She records this pattern as motivation in her proposal.

2.5 The gap

Existing work compares tools with each other or with labelled benchmarks, and professional guidance such as ConsenSys best practices and EthTrust describes what reviewers should check. Few studies test, with controlled designs, whether structuring the human review process around such guidance changes what is missed. That is Lucía's gap. She writes it as a single paragraph her supervisor can challenge, naming what is known, what is assumed by practitioners and what her design will measure that has not been measured before.

Worked example

The literature map links foundations, weakness taxonomies, tool studies and review standards; the overlap lab shows a Jaccard of 0.33 between tool and manual findings, with manual-only findings concerning intent and context.

Synthetic case. Contracts and findings in the lab are synthetic; Nakamoto (2008), Wood, NIST IR 8202, Atzei et al. (2017), Luu et al. (2016), Durieux et al. (2020), Tsankov et al. (2018), Perez and Livshits (2021), the SWC registry, EEA EthTrust and ConsenSys best practices are real sources.

Errors and limits

Treating tool flags as proof of exploitable harm overstates risk, as Perez and Livshits showed.

Exercises

Synthesis

The frontier shows strong tool research but little controlled evidence about structured human review, which defines the thesis gap.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →

Worked answers

EX008. The Ethereum virtual machine that runs contract code, with gas limiting computation.

EX009. Symbolic execution.

EX010. Low agreement between tools and many false positives.

EX011. Contracts flagged as vulnerable were rarely exploited in practice.

EX012. 0.33, with 4 shared findings of 12 distinct.

EX013. Intent and context, such as business logic and oracle dependence.

EX014. Little controlled evidence on whether structuring human review around guidance changes what is missed.