Please note: Importing new articles from Word documents is currently unavailable. We are working on fixing this issue soon and apologize for any inconvenience.

Tianyuan Hu

and 3 more

Smart contract security is essential for blockchain applications. While studies indicate that few reported vulnerabilities are exploited, no follow-up study has been performed to delve into the reasons behind this phenomenon. We aim to understand the reasons for the low exploitation rate to enhance vulnerability detection practices. We first collect 136,969 real-world smart contracts and analyze them using seven vulnerability detectors. Then, we apply Strauss’ grounded theory to gain insights into exploitability. Furthermore, we analyze transaction logs to identify exploitations in history.  Among the 4,364 smart contracts reported as vulnerable by the vulnerability detectors, a noteworthy 75.25% were found to be unexploitable. Merely 66 (0.015%) exploitable contracts have been exploited. We uncover 11 reasons leading to reporting unexploitable vulnerabilities. Additionally, we identified five factors that could potentially reduce the likelihood of exploitable contracts being targeted. Our findings emphasize the importance of not merely treating smart contracts as conventional object-oriented (OO) applications. Researchers need to account for the unique aspects of the Solidity language, the design principles underpinning smart contracts, and specific execution environments. This nuanced approach is essential for minimizing the occurrence of reporting unexploitable vulnerabilities. Based on the study's insights, we propose six recommendations to enhance smart contract vulnerability detection, prioritization, and mitigation.