## 5 Experiments
### Testing Using Tools
However, to align with evolving industry practices, future research may benefit from incorporating more current standards such as the Ethereum Enterprise Alliance (EEA) EthTrust Security Levels [48], which offer a normative framework for security certification and compliance evaluation in modern smart contract development. Another tool used to assess the security of the implemented contract was Slither [46]. Unlike Mythril, which focuses on potential attack scenarios and simulations, Slither performs static code analysis. In addition to identifying vulnerabilities, the tool also detected certain issues related to code optimization and quality. Table 5 presents the observations and potential problems identified using this tool, including suggestions related to code quality, optimization, and access control. One of the key identified issues is the unsafe transfer of \(ETH\), where the _withdraw-Funds()_ function allows arbitrary users to receive funds without proper access restrictions. This lack of control could lead to unauthorized transactions, making it necessary to implement stricter access mechanisms to ensure that only the contract owner or authorized users can execute this function. Another weakness comes from the way the _subscribe_ function handles user-controlled input. The _subscriberAddresses_ array does not have a predefined length limit, meaning that an attacker could exploit this by inserting excessive data, which may eventually overload the contract's memory and increase gas consumption. To mitigate this risk, validation checks should be implemented to prevent duplicate entries and enforce reasonable constraints on the size of the array. The contract also contains a critical flaw related to its self-destruction mechanism, which was also detected by Mythril and described in Table 4 as SWC 106. The contract was implemented using Solidity version (0.8.28), which includes built-in protections against integer overflow and underflow, and supports structured exception handling and improved memory management. Another inefficiency was identified in the _getAllSubscribers_ function, where the loop iterates over an array stored in memory without caching its length. Each iteration requires additional computational resources to fetch the array size, which can lead to performance issues, especially when dealing with large data sets. A simple optimization, such as storing the array length in a local variable before looping, would reduce execution time and lower gas costs. Furthermore, the contract includes a variable, _subscriptionPeriod_, which is not declared as _constant_, even though its value remains unchanged after deployment. In Solidity, marking such variables as _constant_ optimizes gas usage because their values are embedded in the bytecode rather than being stored in memory. Implementing this optimization would result in lower execution costs for functions referencing this variable. Lastly, the _subscribe_ function was declared as _public_, allowing both internal and external calls. However, since this function is designed to be accessed externally, it would be more efficient to declare it as _external_. Furthermore, its parameters should use _calldata_ instead of _memory_, as _calldata_ is optimized for handling external input data, reducing unnecessary memory allocation and improving gas efficiency. Although automated security tools such as Mythril and Slither provide an efficient and systematic means of identifying common vulnerabilities, they are not sufficient for comprehensive smart contract assurance. Manual code audits conducted by experienced developers are essential to detect context-specific and logic-related flaws that automated tools may overlook. Regular reviews, ideally performed at each stage of the development lifecycle, significantly reduce the likelihood that critical exploits go undetected. In addition, such manual analysis revealed broader architectural considerations, particularly with respect to secure access control for financial operations.