Practices for Assessing the Security Level of Solidity Smart Contracts

In 2022, the Ethereum Entreprise Alliance (EEA) published a first version of EthTrust [2], a document that aims to certify the security level of smart contracts written in the Solidity language. A smart contract is a computer code whose execution is triggered by a transaction issued by a peer on a distributed network. Once deployed in a blockchain, the contract is immutable and no security flaw can be corrected. In order to provide an uninitiated user with the means to check the security level of the targeted contract before sending a transaction, it would be desirable to have a tool capable of certifying the security level of smart contracts. With this objective in mind, the work presented in this paper aims to qualify the existing tools for detecting vulnerabilities in contracts, as well as advances based on the use of AI to analyse the Solidity language. Finally, the needs and a methodology are discussed to build a tool for systematically certifying the security level of open source smart contracts.