Statična analiza kode in načrtovalski vzorci pri razvoju pametnih pogodb

PREININGER, DAVID (author), Lavbič, Dejan (mentor)

Ker je razvoj decentraliziranih aplikacij precej drugačen kot razvoj centraliziranih, so razvijalci prisiljeni opustiti stare programerske prakse in se navaditi na drugačen stil programiranja, ki ga te aplikacije zahtevajo. Zanemarjanje tega povzroča varnostne napake v programski kodi. Zato so bile pametne pogodbe v zadnjih nekaj letih pogosta tarča uspešnih hekerskih napadov, kar je privedlo do velikih finančnih izgub. V diplomskem delu se osredotočamo na dopolnitev orodja za statično analizo kode pametnih pogodb, da zaznava (ne)pravilno ali manjkajočo implementacijo načrtovalskih vzorcev, ki so specifični za razvoj decentraliziranih aplikacij. Orodje lahko razvijalci uporabijo, da preverijo, če je njihova koda v skladu z novimi programerskimi vzorci v svetu razvoja decentraliziranih aplikacij in da preverijo, kje v aplikaciji takšni vzorci manjkajo. Ob ovrednotenju orodja smo potrdili, da orodje pravilno vrača opozorila za manjkajoče načrtovalske vzorce in da je povprečni delež nezaščitenih javnih funkcij pri slabo rangiranih pametnih pogodbah decentraliziranih menjalnic za 22,9 % višji, kot pa pri dobro rangiranih.

• Language: Slovenian
• Keywords: statična analiza kode, načrtovalski vzorci, pametne pogodbe, razvoj decentraliziranih aplikacij
• Work type: Bachelor thesis/paper
• Typology: 2.11 - Undergraduate Thesis
• Organization: FRI - Faculty of Computer and Information Science
• Year: 2023
• PID: 20.500.12556/RUL-149489
• COBISS.SI-ID: 163727363
• Publication date in RUL: 07.09.2023

Secondary language

• Language: English
• Title: Static code analysis and design patterns in smart contract development

Abstract

Because the development of decentralized applications differs from centralized ones, developers are forced to give up their old programming habits and learn a new style of programming, required by these applications. Failure to do so leads to security vulnerabilities. This is one of the reasons why smart contracts were often the target of successful hacks, leading to significant financial losses. In this thesis, we have focused on extending a static code analysis tool for smart contracts with detectors for (in)correct or missing implementation of design patterns, specific to the development of decentralized applications. Developers can use it to check whether their code aligns with new programming patterns in developing decentralized applications and where these patterns are missing. While evaluating, we have confirmed, that the tool correctly returns warnings for missing design patterns and that the average proportion of unprotected public functions of poorly ranked smart contracts of decentralized exchanges is higher by 22,9 % than in well-ranked ones.

• Keywords: static code analysis, design patterns, smart contracts, decentralized applications development