VETEOS: Statically Vetting EOSIO Contracts for the "Groundhog Day" Vulnerabilities

—In this paper, we propose V ET EOS, a static vetting tool for the “Groundhog Day” vulnerabilities in EOSIO contracts. In a “Groundhog Day” attack, culprits leverage the distinctive rollback issue in EOSIO contracts, which allows them to persistently execute identical contract code with varying inputs. By using the information exposed in prior executions, these attackers unlawfully amass insights about the target contract, thereby figuring out a reliable method to generate unauthorized profits. To tackle this problem, we formally define this unique vulnerability as a control and data dependency problem, and develop a custom static analysis tool, V ET EOS, that can precisely discover such bugs directly from EOSIO WebAssembly (WASM) bytecode. V ET EOS has detected 735 new vulnerabilities in the wild and outperforms the state-of-the-art EOSIO contract analyzer.