On the Detection Limitations of the Re-entrancy Attacks on Ethereum

In recent years, the emergence of Ethereum has brought people a new way of life. Many users tend to deposit funds into different smart contracts, but the smart contracts are actually different computer programs, so there may be some bugs and vulnerabilities in the smart contract that cause economic losses or bring potential dangers. Since the infamous attack on the “TheDAO” smart contract in 2016 until now, re-entrancy attacks, as one of the main attack methods on Ethereum, have caused serious losses. In response to this problem, many works of literature have proposed off-chain auditing of undeployed smart contracts and on-chain detection of deployed smart contracts, but re-entrancy attacks still emerge endlessly. In this paper, we introduce the limitations of Ethereum re-entrancy attack detection from the causes of re-entrancy attacks, behavioral characteristics, and the shortcomings of existing detection methods. First, we analyze the causes of re-entrancy attacks based on the execution characteristics of smart contracts in actual transactions, and then propose two deficiencies in the run-time attack detection method. Secondly, we selected re-entrancy attack transactions that actually occurred and were officially reported, manually analyzed the smart contracts and call sequences involved in these transactions, summarized two key factors of re-entrancy attacks, and analyzed different re-entrancy attacks, summarizing their behavioral characteristics at the theoretical level.