# Smart Contract and DeFi Security: Insights from Tool Evaluations and Practitioner Surveys

**Authors:** Stefanos Chaliasos, Marcos Antonios Charalambous, Liyi Zhou, Rafaila Galanopoulou, Arthur Gervais, Dimitris Mitropoulos, Ben Livshits  
**arXiv:** [2304.02981](https://arxiv.org/abs/2304.02981)  
**Date:** 2023-04-06  
**Summary page:** https://www.summarizepaper.com/en/paper/2304.02981v1/

## Key points

- Decentralized finance (DeFi) ecosystem built on blockchain technology and smart contracts has led to increased demand for secure and reliable smart contract development.
- Researchers have proposed various automated security tools to detect vulnerabilities in DeFi protocols.
- A recent study evaluated the effectiveness of five state-of-the-art automated security tools in identifying vulnerabilities that can lead to high-profile attacks, along with their overall usage within the industry.
- The findings revealed that the tools could have prevented only 8% of the attacks in the dataset, amounting to $149 million out of the $2.3 billion in losses. All preventable attacks were related to reentrancy vulnerabilities.
- Logic-related bugs and protocol layer vulnerabilities are significant threats not adequately addressed by existing security tools.
- The results emphasize the need to develop specialized tools catering to the distinct demands and expectations of developers and auditors.
- Continuous advancements in security tools are necessary to effectively tackle ever-evolving challenges confronting the DeFi ecosystem.
- This study took a different approach by actually running the tools against exploits and reporting both cases where they had false negatives and cases where they lacked appropriate oracles.

## Summary

The decentralized finance (DeFi) ecosystem built on blockchain technology and smart contracts has led to an increased demand for secure and reliable smart contract development. To address this issue, researchers have proposed various automated security tools to detect vulnerabilities. In a recent study by Zhang et al., the effectiveness of five state-of-the-art automated security tools in identifying vulnerabilities that can lead to high-profile attacks was evaluated, along with their overall usage within the industry. The study encompassed an analysis of 127 high-impact real-world attacks resulting in $2.3 billion in losses and a survey of 49 developers and auditors working in leading DeFi protocols. The findings revealed that the tools could have prevented only 8% of the attacks in the dataset, amounting to $149 million out of the $2.3 billion in losses. Notably, all preventable attacks were related to reentrancy vulnerabilities. Furthermore, practitioners distinguish logic-related bugs and protocol layer vulnerabilities as significant threats that are not adequately addressed by existing security tools. The results emphasize the need to develop specialized tools catering to the distinct demands and expectations of developers and auditors. The study also highlights the necessity for continuous advancements in security tools to effectively tackle the ever-evolving challenges confronting the DeFi ecosystem. While previous studies focused on evaluating automated security tools using datasets of known vulnerable contracts or contracts with induced vulnerabilities, this study took a different approach by actually running the tools against exploits and reporting both cases where they had false negatives and cases where they lacked appropriate oracles. Overall, this mixed-methods investigation into the effectiveness and usage of security tools provides a comprehensive overview of their current status and offers valuable insights for researchers and practitioners to advance the state-of-the-art in smart contract and DeFi security.