# MSmart: Smart Contract Vulnerability Analysis and Improved Strategies Based on Smartcheck
## 5 Experiment
### MSmart vs. Other Tools  
Oyente is the first smart contract detection tool that uses contract control flow diagrams and symbolic execution to find smart vulnerabilities. Transaction order dependencies, integer overflow vulnerabilities, etc. are all detected by Oyente. Oyente has high false negatives but few false positives. The official suggested tool for detecting smart contracts in Ethereum is Mythril, which uses symbolic execution to find smart contract vulnerabilities. The majority of vulnerabilities can be successfully detected via Mythril. Slither is a smart contract vulnerability detection tool that uses an intermediate representation and can identify vulnerabilities from a syntactic standpoint. Therefore, we choose these tools. Next, the test dataset is the dataset given by smartbugs [39] and a small number of validated vulnerable smart contracts in order to make the experiment realistic and fair. Finally, through analysis results, MSmart has made a series of improvements in both false negatives and false positives. The analysis results are shown in Table 5.  
The experimental analysis shows the following:  
(1) For integer overflow vulnerabilities: Oyente, Mythril and MSmart can detect most of the integer overflow vulnerabilities. On the other hand, this kind of smart contract vulnerability detection is not supported by Slither and Smartcheck. MSmart detects 13 out of 15 vulnerable smart contracts (note: MSmart has more detected vulnerabilities than other tools). This demonstrates that MSmart is superior to other mitigation techniques for integer overflow vulnerabilities. (2) For timestamp dependence vulnerabilities: Oyente, Slither, Smartcheck, and MSmart can detect this type of vulnerability. This kind of smart contract vulnerability detection is not supported by Mythril. Oyente detects if a money flow depends on the timestamp. Therefore, some of the timestamp vulnerabilities that are not related to money flow cannot be detected. Smartcheck and Slither's detection algorithms are not flawless. MSmart offers a more thorough defense against timestamp dependence vulnerabilities. (3) For DOS vulnerabilities: MSmart can detect this type of vulnerability. On the other hand, this kind of smart contract vulnerability detection is not supported by Oyente, \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Project** & **Indicator** & **Smartcheck** & **MSmart** \\ \hline \multirow{3}{*}{Project1} & _TP_/_FP_/_FN_ & 1/10/5 & 5/10/5 \\  & _FDR_ (\%) & 9.1 & 33.3 \\  & _FNR_ (\%) & 83.3 & 50.0 \\  & _TP_/_FP_/_FN_ & 2/8/6 & 6/8/2 \\ Project2 & _FDR_ (\%) & 20.0 & 42.8 \\  & _FNR_ (\%) & 75.0 & 25.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of MSmart and Smartcheck on specific projects. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Smart Contract Vulnerability** & & & & \\
**Categories (Number of** & **Oyente** & **Mythril** & **Slither** & **Smartcheck** & **MSmart** \\
**Vulnerabilities** & & & & & \\ \hline integer overflow (15) & 11 & 12 & 0 & 0 & 13 \\ timestamp dependence (5) & 1 & 0 & 1 & 1 & 2 \\ DOS (6) & 0 & 0 & 0 & 0 & 2 \\ self-destruct (5) & 0 & 5 & 5 & 1 & 5 \\ Delegatecall (5) & 0 & 5 & 5 & 0 & 5 \\ \hline \hline \end{tabular} Note: the numbers in the table all represent the number of vulnerabilities detected by each tool.  
\end{table} 
Table 5: Comparison of MSmart and other tools. Mythril, Slither, and Smartcheck. Based on the analysis's findings, MSmart has been able to guard against this kind of vulnerability. (4) For self-destruct vulnerabilities: Mythril, Slither, Smartcheck, and MSmart can detect this type of vulnerability. This kind of smart contract vulnerability detection is not supported by Oyente. Smartcheck's detection rules for such vulnerabilities are not perfect. Therefore, only one can be detected. Mythril, Slither, and Smartcheck can detect all of them. (5) For delegatecall vulnerabilities: Mythril, Slither and Smartcheck can detect this type of vulnerability.