SCIF: Compositional Security for Smart Contracts

I. Information Flow Control (IFC)

II. Defending Against Confused Deputy Attacks (CDA)

• Static Type Checking: SCIF leverages its information flow control system to statically verify that the trust levels required by a called method align with the trust level of the caller. If a mismatch is detected at compile time, the code is flagged as potentially vulnerable, prompting the programmer to address the issue.
• Dynamic Type Checking: Recognizing that static analysis alone cannot guarantee security in an open system where malicious actors can provide ill-typed code, SCIF implements run-time checks to enforce type safety. These checks ensure that the actual type of a called method matches the expected type at the point of invocation, effectively preventing type confusion attacks that form the basis of many CDAs. This dynamic verification is crucial as it prevents attackers from exploiting the system by passing in malicious code disguised as a different, trusted type.

III. Exceptions vs. Failures

• Exceptions: Similar to exceptions in other programming languages, SCIF exceptions represent foreseeable deviations from normal execution flow and do not necessitate the rollback of state changes. They are explicitly declared in method signatures, enabling programmers to anticipate and handle them gracefully using try-catch blocks. This explicit handling makes the code more robust and less prone to errors caused by uncaught exceptions.
• Failures: In contrast to exceptions, failures signify unrecoverable errors, such as resource exhaustion or system-level faults. When a failure occurs, SCIF triggers a transactional rollback, reverting any state changes made within the failing scope. This mechanism ensures that the system remains in a consistent state even in the event of unexpected errors.

Conclusion