# The State of Ethereum Smart Contracts Security: Vulnerabilities, Countermeasures, and Tool Support
## 5 Security-Analysis Tools
### Comparisons
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Tools Name** & **Methods** & **Vulnerabilities Covered** & **Accuracy** & **Efficiency** \\ \hline \multirow{3}{*}{Oyente [13]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{High (94.3\%)} & 29.5 s per \\  & & & Transaction order dependence, Timestamp dependence, & \\  & & Mishandled exceptions, Re-entrancy. & & \\ \hline \multirow{3}{*}{Securify [36]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Not reported} & \multirow{3}{*}{30 s per contract} \\  & & & Freezing Ether, Re-entrancy, Delegatedcall to insecure contracts, & \\  & & Mishandled exceptions, Transaction order dependency, & & \\  & & Short address/parameter issues & & \\ \hline \multirow{3}{*}{SmartCheck [38]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Low (31.11\%)} & \multirow{3}{*}{1.67 per contract} \\  & & Re-entrancy, Tx.origin, Freezing Ether, Arithmetic Issues, & \\  & & Timestamp dependence; **Self-defined vulnerabilities:** & & \\  & & Unchecked external calls, DoS by external contract & & \\ \hline \multirow{3}{*}{DefectChecker [43]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Medium (84.16\%)} & 2.42 s per \\  & & & Mishandled exceptions, Timestamp dependence; & \\  & & **Self-defined vulnerabilities:** DoS, Strict balance equality, & & (84.16\%) & contract \\  & & Nested call, Unchecked external calls. & & \\ \hline \multirow{3}{*}{ContractWard [44]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{High (96\%)} & \multirow{3}{*}{4 s per contract} \\  & & & Re-entrancy, Self-defined vulnerabilities:** & & \\  & & stack size limit (deprecated) & & \\ \hline \multirow{3}{*}{NPChecker [46]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & Timestamp dependence, & \multirow{3}{*}{High (94\%)} & 351 s per \\  & & Re-entrancy, Transaction order dependence; & & \\  & & **Self-defined vulnerabilities:** & & contract \\  & & & non-determinism-related smart-contract payment bugs. & \\ \hline \multirow{3}{*}{MadMax [41]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Medium (81\%)} & 5.9 s per \\  & & **Self-defined vulnerabilities:** & & contract \\  & & Unbounded mass operations, Non-isolated external calls. & & \\ \hline \multirow{3}{*}{Osiris [45]} & \multirow{3}{*}{Static} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Not reported} & \multirow{3}{*}{75 s per contract} \\  & & **Self-defined vulnerabilities:** & & \\  & & Modulo zero, Type cast, Signedness. & & \\ \hline \multirow{3}{*}{ContractFuzzer [49]} & \multirow{3}{*}{Dynamic} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Softefestruct,} & \multirow{3}{*}{High (98.91\%)} & \multirow{3}{*}{Not reported} \\  & & Mishandled exception, Re-entrancy, Timestamp dependency, & Delegatedcall to insecure contracts, Freezing ether. & \\ \hline \multirow{3}{*}{Sereum [54]} & \multirow{3}{*}{Dynamic} & **Self-defined Re-entrancy vulnerabilities:** & \multirow{3}{*}{High (99.4\%)} & 2494.5 ms per \\  & & Cross-function reentrancy, & & block runtime \\  & & Delegated reenntrancy and Create-based reentrancy & & (2277.0 ms on \\  & & & Geth) \\ \hline \multirow{3}{*}{sFuzz [52]} & \multirow{3}{*}{Dynamic} & **Vulnerabilities in the taxonomy:** & \multirow{3}{*}{Generates 208} \\  & & Selfdestruct, Mishandled exceptions, Re-entrancy, & & test cases per \\ \cline{1-1}  & & Timestamp dependency, Delegatecall to insecure contracts, & & second on \\ \cline{1-1}  & & Arithmetic Issues, freezing ether & & average. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: A comparison of security-analysis tools. The first two rows were studied before 2018 by Dika in [11]. Note that the accuracy and efficiency of these tools are not really comparable as they rely on self-defined metrics by their authors. We consider reported accuracy above 90% as high, below 50% as low, and the rest as medium.