List of Security Vulnerabilities
A collection of smart contracts that have undergone formal verification using the K-framework to ensure correctness against specifications.
What is List of Security Vulnerabilities?
Verified Smart Contracts is a repository of smart contracts that have been formally verified using the K-framework. It provides mathematically proven correctness guarantees by specifying intended behaviors and verifying that the compiled code satisfies those specifications through symbolic execution and reachability logic. This addresses the critical need for security and reliability in blockchain applications where bugs can lead to significant financial losses.
Smart contract developers, blockchain security researchers, and organizations deploying high-value contracts who require rigorous assurance of correctness. It is also valuable for academics and practitioners interested in formal methods applied to blockchain technology.
Developers choose this project because it offers a transparent, verifiable approach to smart contract security beyond traditional audits, using formal methods to exhaustively check compliance with specifications. The use of the K-framework and reachability logic provides a robust, semantics-based verification infrastructure trusted for critical contracts like Ethereum 2.0 and GnosisSafe.
Overview
Smart contracts which are formally verified
Use Cases
Best For
- Auditing high-stakes smart contracts like deposit or governance mechanisms
- Learning formal verification techniques applied to blockchain code
- Referencing verified implementations of common standards like ERC20
- Enhancing security postures for DeFi or token projects
- Researching semantics-based program verification tools
- Validating compiler outputs for Solidity or Vyper code
Not Ideal For
- Projects needing rapid security audits or quick deployment timelines
- Teams without expertise in formal methods or the K-framework
- Low-budget or non-critical applications where verification cost is unjustified
- Developers seeking a tool to automatically verify arbitrary new contracts
Pros & Cons
Pros
Provides exhaustive verification using reachability logic and symbolic execution in the K-framework, ensuring all code paths meet formal specifications as described in the README.
Formal specs are created through discussions with contract owners, catching bugs early and aligning intent with implementation, a key step highlighted in the verification process.
Includes high-profile contracts like Ethereum 2.0 Deposit and Uniswap, offering trusted examples for common blockchain use cases, as listed in the repository.
Leverages Z3 to solve constraints during symbolic execution, enhancing the efficiency and robustness of proofs, mentioned in the verification approach.
Cons
Requires installation and deep understanding of the K-framework, making it inaccessible without significant upfront investment, as noted in the Resources section.
The repository only contains pre-verified contracts, not a tool for verifying new or arbitrary contracts, limiting its utility for broader applications.
Uses 'The Reproducibility License 1.1.0', which imposes conditions that may hinder broader adoption or modification, as highlighted in the License section.
Correctness depends on the K-framework, KEVM, and Z3, adding layers of trust that could be points of failure, as acknowledged in the disclaimer.
Frequently Asked Questions
Related Projects
List of Known BugsA JSON-formatted list of some of the known security-relevant bugs in the Solidity compiler
SWC RegistrySmart Contract Weakness Classification and Test Cases
A Survey of Security Vulnerabilities in Ethereum Smart ContractsExplains eight vulnerabilities that are specific to the application level of blockchain technology by analyzing the past exploitation case scenarios of these security vulnerabilities
246 Findings246 Findings From Trail of Bits Smart Contract Audits
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.