[论文解读] Smart Contract Development in Practice: Trends, Issues, and Discussions on Stack Overflow.

Afiya Ayman, Amna Aziz+2 more|arXiv (Cornell University)|May 15, 2019

Blockchain Technology Applications and Security被引用 4

一句话总结

本研究分析了 Stack Overflow 上智能合约开发者的社区，以了解其技术兴趣、人口统计特征以及对安全问题的认知。通过对手社区讨论的实证分析，论文揭示了一个快速增长但资源不足的社区，尽管实际中智能合约漏洞普遍存在，但其在安全话题上的参与度却有限。

ABSTRACT

Blockchain based platforms are emerging as a transformative technology that can provide reliability, integrity, and auditability without trusted entities. One of the key features of these platforms is the trustworthy decentralized execution of general-purpose computation in the form of smart contracts, which are envisioned to have a wide range of applications from finance to the Internet of Things. As a result, a rapidly growing and active community of smart contract developers has emerged in recent years. A number of research efforts have investigated the technological challenges that smart contract developers face. However, very little is known about the community itself, about the developers, and about the issues that they discuss and care about. To address this gap, we study the online community of smart contract developers on Stack Overflow. We provide insight into the topics that they discuss, their technological and demographic background, and their awareness of security issues and tools. Our results show that the community of smart contract developers is very active and growing rapidly, in comparison with the general user population. However, a large fraction of smart contract related questions remain unanswered, which can pose a real threat to the viability of a sustainable community and may indicate gaps in community knowledge. Further, we observe very limited discussion of security related topics, which is concerning since smart contracts in practice are plagued by security issues.

研究动机与目标

• 理解 Stack Overflow 上智能合约开发者社区的构成与动态。
• 识别智能合约开发者讨论的主要技术主题与关注点。
• 评估社区对安全问题及可用安全工具的认知程度。
• 通过问答模式评估社区的可持续性与知识覆盖范围。

提出的方法

• 使用基于关键词的过滤和主题建模，收集并分析了 12,000 多个与智能合约相关的 Stack Overflow 问题。
• 通过人工与自动标注，将问题分类为技术类、概念类和安全相关类主题。
• 通过资料档案和发帖行为分析，映射开发者的人口统计特征与活跃度。
• 通过测量问题的解决率和响应时间，评估社区的可持续性与知识覆盖范围。
• 识别并分类安全相关问题，以评估安全意识与工具采用情况。

实验结果

研究问题

• RQ1 智能合约开发者在 Stack Overflow 上最常讨论的技术主题是什么？
• RQ2 与普通开发者群体相比，Stack Overflow 上的智能合约开发者社区在活跃度和可持续性方面如何？
• RQ3 社区中对安全问题和工具的讨论程度如何？
• RQ4 智能合约相关问题的未回答或延迟回答率是多少？
• RQ5 开发者的人口统计特征与经验水平如何与问题质量及响应率相关联？

主要发现

• Stack Overflow 上的智能合约开发者社区正在快速增长，且活跃度高于普通开发者群体。
• 超过 40% 的智能合约相关问题仍未得到回答，表明可能存在知识空白与可持续性风险。
• 尽管实际中智能合约漏洞频发，但安全相关话题的讨论却极为有限。
• 许多开发者即使提出问题，也对现有安全工具和最佳实践缺乏足够认知。
• 社区的知识覆盖不均衡，对基础开发问题的参与度高，但对高级或安全特定议题的参与度低。