# The State of Ethereum Smart Contracts Security: Vulnerabilities, Countermeasures, and Tool Support
## 5 Security-Analysis Tools
### Recent Security-Tools Support
\begin{table}
\begin{tabular}{l l l l l l l l l l} \hline \hline
**Security Tool** & **\(\checkmarkmark\)** & **\(\checkmark\)** & **\(\checkmark\)** & **\(\checkmark\)** & **\(\checkmark\)** & **\(\checkmark\)** & **\(\checkmark\)** \\ \hline Oyente & \(\checkmark\) & & & & \(\checkmark\) & & \(\checkmark\) & \(\checkmark\) & \\ \hline Securify & \(\checkmark\) & & \(\checkmark\) & & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & & \\ \hline SmartCheck & \(\checkmark\) & \(\checkmark\) & & \(\checkmark\) & & \(\checkmark\) & & \(\checkmark\) & \\ \hline DefectChecker & \(\checkmark\) & & & & \(\checkmark\) & & \(\checkmark\) & \(\checkmark\) & \\ \hline ContractWard & \(\checkmark\) & \(\checkmark\) & & & & & \(\checkmark\) & \(\checkmark\) & \\ \hline NPChecker & \(\checkmark\) & & & & & & \(\checkmark\) & \(\checkmark\) & \\ \hline MadMax & & \(\checkmark\) & & & & & & \\ \hline Osiris & & \(\checkmark\) & & & & & & \\ \hline ContractFuzzer & \(\checkmark\) & & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) \\ \hline Sereum & \(\checkmark\) & & & & & & & \\ \hline sFuzz & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) & \(\checkmark\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Tools and vulnerabilities matrix. **MadMax. ** The MadMax tool uses the Vandal decompiler [42] to produce CFG, a three-address code for all operations in the smart contract, and function boundaries [41]. Then it analyzes the three-address-code representation, recognizes concepts such as loops and induction variables, analyzes memory and dynamic data structures, and infers the concept of gas-focused vulnerabilities. This tool only detects _gas-focused vulnerabilities_, such as unbounded mass operations (infinite or nearly infinite loops), external calls that throw out-of-gas exceptions or arithmetic integer overflows, because those vulnerabilities will cause unexpected gas consumption. **Osiris. ** The Osiris combines symbolic analysis and taint analysis technology to find integer bugs in smart contracts [45]. It has three components: symbolic analysis, taint analysis and integer error detection. The symbolic analysis component creates CFG and symbolical executions of every path in the CFG. Then, the taint analysis part checks for taints across the stack, memory and storage, and integer error detection looking for possible integer bugs within the executed instruction. **contractFuzzer. ** The contractFuzzer tool combines static analysis of ABI and bytecodes and fuzzing technology to explore vulnerabilities of smart contracts [49]. It creates an Ethereum test net using offline EVM to monitor the execution of the smart contracts and extract information from the execution process. By analyzing the ABIs and bytecodes, contractFuzzer calculates the function selector (first four bytes of the hash of the function's signature) and maps each ABI function to a set of function selectors used. Then an input generation algorithm is created to fuzz each function based on the information of the previous step. It collects three types of test oracles during the execution of smart contracts: attributes of a contract call or delegatcall, run-time information about opcodes invoked, and the state of the contract. **Sereum. ** It is a modified Ethereum client based on Geth [97] that focuses on re-entrancy vulnerabilities [54]: _cross-function re-entrancy_, _delegated re-entrancy_, and _create-based re-entrancy_. The cross-function re-entrancy is to re-enter another function in the same contract. The delegated re-entrancy is to re-enter a smart contract via delegatcall to an unsafe library that may use address.call().value() to call back to the original contract. The create-based re-entrancy utilizes the fact that a newly created contract will have its constructor function executed immediately when the contract is deployed. The constructor is deemed safe and trusted, but it could contain external calls to malicious contracts.