[Paper Review] Exploring Security Practices of Smart Contract Developers

Tanusree Sharma, Zhixuan Zhou+2 more|arXiv (Cornell University)|Apr 24, 2022

Blockchain Technology Applications and Security4 citations

TL;DR

This study investigates smart contract developers' security practices through interviews and code reviews with 29 developers, revealing significant gaps in security awareness and vulnerability detection—especially among early-stage developers. It finds that 15% of early-stage developers identified vulnerabilities in a code review task, compared to 55% of experienced developers, highlighting the need for better education and tooling to close the security knowledge gap in blockchain development.

ABSTRACT

Smart contracts are self-executing programs that run on blockchains (e.g., Ethereum). 680 million US dollars worth of digital assets controlled by smart contracts have been hacked or stolen due to various security vulnerabilities in 2021. Although security is a fundamental concern for smart contracts, it is unclear how smart contract developers approach security. To help fill this research gap, we conducted an exploratory qualitative study consisting of a semi-structured interview and a code review task with 29 smart contract developers with diverse backgrounds, including 10 early stage (less than one year of experience) and 19 experienced (2-5 years of experience) smart contract developers. Our findings show a wide range of smart contract security perceptions and practices including various tools and resources they used. Our early-stage developer participants had a much lower success rate (15%) of identifying security vulnerabilities in the code review task than their experienced counterparts (55%). Our hierarchical task analysis of their code reviews implies that just by accessing standard documentation, reference implementations and security tools is not sufficient. Many developers checked those materials or used a security tool but still failed to identify the security issues. In addition, several participants pointed out shortcomings of current smart contract security tooling such as its usability. We discuss how future education and tools could better support developers in ensuring smart contract security.

Motivation & Objective

• To understand how smart contract developers perceive and approach security in their development processes.
• To compare security practices and vulnerability detection abilities between early-stage and experienced smart contract developers.
• To identify gaps in current security tools, resources, and educational support for developers.
• To inform the design of better developer tools and educational frameworks for smart contract security.

Proposed method

• Conducted semi-structured interviews with 29 smart contract developers, including 10 early-stage and 19 experienced developers.
• Performed a code review task on a smart contract containing four common vulnerabilities to assess detection ability.
• Applied hierarchical task analysis to examine the steps and strategies developers used during code reviews.
• Collected data on tool usage, documentation access, and perceived usability challenges of existing security tools.
• Analyzed qualitative responses to identify patterns in security perceptions, practices, and tool limitations.

Experimental results

Research questions

• RQ1 How do smart contract developers approach or ensure security for smart contracts, and how do these practices differ between early-stage and experienced developers?
• RQ2 How do developers conduct code reviews, and what is their success rate in identifying common smart contract security vulnerabilities?
• RQ3 What are the perceived limitations of current smart contract security tools, and how do they affect developer practices?

Key findings

• Early-stage developers had a 15% success rate in identifying security vulnerabilities during a code review task, compared to 55% for experienced developers.
• Many developers, especially early-stage ones, accessed documentation and security tools but still failed to detect known vulnerabilities, indicating a gap in comprehension or application.
• Participants reported that existing security tools are often hard to use, have poor user interfaces, and are not integrated into development workflows.
• A significant number of developers rely on external audits or third parties for security assurance, indicating low self-confidence in in-house vulnerability detection.
• Many early-stage developers do not prioritize security because they deploy primarily on testnets, where bugs have no real-world impact.
• There is a strong need for better educational resources, such as security-focused testnets with intentionally vulnerable contracts, to improve developer awareness and skill.