A guideline-based framework for building and maintaining secure and cost-effective smart contracts
Creators: name: N'Da, Aboua Ange Kevin
Publisher: name: Zenodo
Year: 2024

description: There is an explosion of interest in Blockchain technology. To date, Blockchain is widely used in sectors such as financial transactions, supply chain, health, and other sectors including asset management. This technology offers users the ability to interact through a peer-to-peer network system without trusting each other and without any intermediary. Blockchain technology presents interesting characteristics including machine-based decentralized governance, transparency, and immutability. These characteristics allow the Blockchain to ensure fast peer-to-peer transactions in which data are recorded, publicly available, and impossible to be altered by anyone. The development of features such as smart contract- a software program running on top of the Blockchain has allowed the Blockchain to extend its application beyond financial transactions.However, the implementation of smart contracts on top of the Blockchain does not guarantee that smart contracts are secure and free from defects. Many smart contracts have been the target of attacks resulting in huge loss of data and assets. Smart contract vulnerabilities, therefore, limit the impact of the Blockchain on businesses and practitioners. The existing research to tackle smart contract vulnerabilities is mainly focused on vulnerability classification and static analysis tools. Although these solutions may help to deal with smart contract security, they do not prevent smart contract developers from introducing errors in their code. Furthermore, considering the immutability of Blockchain which prevents smart contract code from being altered, these solutions are not effective enough to deal with smart contract security.In this thesis, we aim to provide a comprehensive solution to support secure smart contract development. To achieve our goal, we explore other existing security solutions including security programming practices and patterns, software metrics from non-blockchain software, and maintainability approaches from smart contracts to propose a comprehensive guideline-based framework. Firstly, we investigate the security programming practices and patterns of the non-Blockchain software in smart contracts by evaluating their applicability as well as their implementation cost. Security programming practices and patterns which are widely used in the non-Blockchain software development process have been contributing to improving the security of the non-Blockchain software. In this research, we investigate the applicability of a list of security programming practices and their cost through a case study involving smart contracts. By using systematic judgment and statistical methods, the result of our study shows that security programming practices and patternsfrom non-Blockchain software can be applied to smart contracts, and their implementation cost is not significant enough to deter practitioners from implementing them. Secondly, we look at security metrics by investigating their applicability to smart contracts. Looking at security metrics to complement the previous investigation to measure the security level of smart contracts during development. Given the immutability of Blockchain, we intend to provide developers with tools to decide if their smart contracts are ready to be deployed. Therefore, we empirically evaluate the applicability of the identified security metrics from three measurement properties (construct, measurement, and reliability) by using a case study involving a list of smart contracts. The result of this research shows that most of the security metrics from non-blockchain software can also be implemented in smart contracts and some help to measure smart contract security.Furthermore, this thesis also investigates the cost and the evolution of smart contracts implementing upgradability standard methods provided by the Ethereum community. We look at this direction as it may help to improve the smart contract security by updating the security level during the maintenance if the practitioner can afford the cost. We, therefore, statistically evaluate the cost, size, complexity, and quality of the smart contract over a period through a case study involving a list of 18 smart contract projects. The research results show that, among the upgradability methods, the EIP-2535 implies less cost for smart contract maintenance, and that the smart contract evolutionary behaviour with regard to size, complexity, and quality follows Lehman’s laws.Finally, a guideline-based framework is developed for the development of secure- and cost-effective smart contracts with the insights identified from our investigations. The proposed framework is based on foundations that have been elaborated with the elements that we identified and considered as the factors of the security, and cost improvement of the smart contract development. This proposed framework includes both the development and maintenance phases of smart contracts. An example of an abstract implementation of this framework is provided in this thesis.