以太坊平台的去中心化應用漏洞掃描分析

Analysis of Decentralized Application Security of Ethereum Platform

辜育誠(Yu-Cheng Ku)

指導教授 ： 楊吳泉

義守大學/電機資訊學院/資訊工程學系/碩士(2019年)

摘要

區塊鏈技術區中心化特性有重要不容忽視的特性，因此有著大量應用。伴隨而來的是許多區塊鏈應用的資訊安全議題與事件。一些開發者在缺乏安全實務措施的背景下，開發出了本身具有安全漏洞的應用程式，使得區塊鏈使用者在使用區塊鏈相關應用時必須承受額外的資安風險。這些資訊安全議題也不是區塊鏈技術本身的缺失，而是開發者在開發階段產生的資訊安全問題。
本論文針對區塊鏈之中的去中心化應用使用漏洞掃描工具進行分析，掃描的資料來源取自以太坊(Ethereum)區塊鏈平台上所有已佈署並且仍在運行中的去中心化應用。對於這些應用進行安全分析，了解去中心化應用之資訊安全趨勢，並且依照分析結果提供資訊安全分析與改善建議，以強健區塊鏈去中心化應用之資訊安全。

關鍵字

區塊鏈 ； 以太坊 ； 去中心化應用 ； 資訊安全 ； 弱點掃描

並列摘要

There are many applications because of the decentralization of blockchain. Accompanied by information security issues and events in many blockchain applications. In the context of the lack of security practices and knowledge, some developers have developed decentralized applications that have security vulnerabilities, so the users are risk when they use the applications. These information security issues are not in blockchain technology, but in the phase of implementations.
In this thesis, we analyze the decentralized applications by using the vulnerability-scanning tool. The scanned applications are all in the Ethereum platform, and all the decentralized applications that are still at work. According to the security analysis of the decentralized applications, we provide information security analysis and improvement recommendations to strengthen the information security of decentralized application.

並列關鍵字

Blockchain ； Ethereum ； Decentralized application ； Information security ； Vulnerability scanning

參考文獻

[1.] Barton, J. (2018, 11 8). How many Ethereum smart contracts are there? . Retrieved from coindiligent: https://coindiligent.com/how-many-ethereum-smart-contracts

[2.] b-mueller, JoranHonig, norhh, #4dmuhs. (2017, 10 4). ConsenSys/mythril-classic. Retrieved from Github: https://github.com/ConsenSys/mythril-classic

[3.] David Wong, Mason Hemmel. (2018, 5 23). DASP - TOP 10. Retrieved from dasp.co: https://dasp.co/

[4.] David Wong, Mason Hemmel. (2018年05月18日). 以太坊智能合約安全 Dasp Top10. (愛上平頂山, 編者) 擷取自 Paper 安全技術精粹: https://paper.seebug.org/603/

[5.] Enigmatic. (2019, 07 14). Using Securify for Safer Smart Contracts. Retrieved from medium.com: https://medium.com/coinmonks/using-securify-for-safer-smart-contracts-8d59de22a762