The usage of error handling in Solidity smart contracts is vital because smart contracts perform transactions that should be verified. Transactions that are not carefully handled, may lead to program crashes and vulnerabilities, implying financial loss and legal consequences. While Solidity designers attempt to constantly update the language with new features, including error-handling (EH) features, it is necessary for developers to promptly absorb how to use them. We conduct a large-scale empirical study on 283K unique open-source smart contracts to identify patterns regarding the usage of Solidity EH features over time. Overall, the usage of most EH features is limited. However, we observe an upward trend (> 60%) in the usage of a Solidity-tailored EH feature, i.e., require. This indicates that designers of modern programming languages may consider making error handling more tailored to the purposes of each language. Our analysis on 102 versions of the Solidity documentation indicates the volatile nature of Solidity, as the language changes frequently, i.e., there are changes on EH features once or twice a year. Such frequent releases may confuse smart contract developers, discouraging them to carefully read the Solidity documentation, and correctly adopt EH features. Furthermore, our findings reveal that nearly 70% of the examined smart contracts are exposed to potential failures due to missing error handing, e.g., unchecked external calls. Therefore, the use of EH features should be further supported via a more informative documentation containing (1) representative and meaningful examples and (2) details about the impact of potential EH misuses.
翻译:Solidity 智能合约中错误处理的使用至关重要,因为智能合约执行需要验证的交易。若交易处理不当,可能导致程序崩溃和漏洞,进而造成经济损失和法律后果。尽管 Solidity 设计者不断尝试通过新增功能(包括错误处理功能)来持续更新该语言,但开发者仍需快速掌握这些功能的使用方法。我们对 283,000 份开源智能合约开展了大规模实证研究,以识别随时间推移的 Solidity 错误处理功能使用模式。总体而言,大多数错误处理功能的使用率有限。然而,我们观察到面向 Solidity 定制的错误处理功能(即 require)的使用呈上升趋势(超过 60%)。这表明现代编程语言的设计者或许应考虑使错误处理机制更贴合各自语言的用途。通过对 Solidity 文档 102 个版本的分析,我们注意到该语言频繁更新(即错误处理功能每年变更一至两次),体现了其不稳定性。这种高频发布可能令智能合约开发者感到困惑,导致他们不愿仔细阅读 Solidity 文档并正确采用错误处理功能。此外,我们的研究发现,近 70% 的被检查智能合约因缺少错误处理(例如未检查外部调用)而面临潜在故障风险。因此,需要通过更具信息量的文档进一步支持错误处理功能的使用,该文档应包含:(1) 具有代表性且意义明确的示例;(2) 潜在错误处理误用的影响细节。