[论文解读] Smart Contract Upgradeability on the Ethereum Blockchain Platform: An Exploratory Study

Ilham Qasse, Mohammad Hamdaqa+1 more|arXiv (Cornell University)|Apr 13, 2023

Blockchain Technology Applications and Security被引用 4

一句话总结

本研究通过分析经验证的智能合约，调查以太坊上智能合约的可升级性，识别升级模式，追踪版本演进，并评估升级对合约活动和生命周期的影响。通过代码分析与交易追踪，研究发现仅有极少数可升级合约实际上被升级，且升级与活动增加及生命周期延长相关，凸显了在实际应用中可升级性模式面临的实际挑战。

ABSTRACT

Context: Smart contracts are computerized self-executing contracts that contain clauses, which are enforced once certain conditions are met. Smart contracts are immutable by design and cannot be modified once deployed, which ensures trustlessness. Despite smart contracts' immutability benefits, upgrading contract code is still necessary for bug fixes and potential feature improvements. In the past few years, the smart contract community introduced several practices for upgrading smart contracts. Upgradeable contracts are smart contracts that exhibit these practices and are designed with upgradeability in mind. During the upgrade process, a new smart contract version is deployed with the desired modification, and subsequent user requests will be forwarded to the latest version (upgraded contract). Nevertheless, little is known about the characteristics of the upgrading practices, how developers apply them, and how upgrading impacts contract usage. Objectives: This paper aims to characterize smart contract upgrading patterns and analyze their prevalence based on the deployed contracts that exhibit these patterns. Furthermore, we intend to investigate the reasons why developers upgrade contracts (e.g., introduce features, fix vulnerabilities) and how upgrades affect the adoption and life span of a contract in practice. Method: We collect deployed smart contracts metadata and source codes to identify contracts that exhibit certain upgrade patterns (upgradeable contracts) based on a set of policies. Then we trace smart contract versions for each upgradable contract and identify the changes in contract versions using similarity and vulnerabilities detection tools. Finally, we plan to analyze the impact of upgrading on contract usage based on the number of transactions received and the lifetime of the contract version.

研究动机与目标

• 理解真实世界以太坊部署中智能合约可升级性模式的普遍性和采用情况。
• 通过追踪合约版本和升级事件，研究可升级合约的实际使用情况。
• 分析升级在实践中如何影响合约的活动水平和寿命。
• 识别最常使用的升级模式及其实现特征。
• 为设计时可升级性与运行时升级采用之间的差距提供实证洞察。

提出的方法

• 从 Etherscan 收集经验证的智能合约元数据和源代码以供分析。
• 基于正则表达式和代码结构的自定义策略，识别可升级合约及其升级模式。
• 利用部署时间戳和版本追踪，追踪合约版本的传承关系，以识别升级事件。
• 使用相似性检测和漏洞分析工具，比较不同合约版本之间的变更。
• 通过交易量测量合约活动，并使用时间序列上的回归模型计算活动水平。
• 通过比较升级前后的交易模式，评估升级对合约生命周期和用户参与度的影响。

实验结果

研究问题

• RQ1 RQ1: 在以太坊上部署的智能合约中，升级模式的普遍程度如何？
• RQ2 RQ2: 实际中，可升级合约被升级的可能性有多大？
• RQ3 RQ3: 升级如何影响智能合约的活动水平和生命周期？
• RQ4 RQ4: 在真实世界智能合约开发中，最常使用的升级模式是什么？
• RQ5 RQ5: 设计时可升级性与生产环境中实际升级使用之间存在多大差距？

主要发现

• 仅有极少数可升级合约实际上被升级，表明设计能力与实际应用之间存在显著差距。
• 经历升级的合约相比未升级的合约，通常表现出更高的交易量和更长的生命周期。
• 代理模式是最普遍的可升级性方法，其次是钻石模式及其他新兴模式。
• 许多合约未发出事件或未使用数组来追踪状态变化，限制了跨版本追踪状态演进的能力。
• 尽管存在可升级性模式，开发者往往未能以支持可验证和可追踪升级的方式实现它们。
• 研究发现，可升级性并未被普遍采用，大多数合约在实践中仍保持不可变，尽管其设计支持升级。