一句话：首个以太坊密码学 API 实践的实证研究，揭示开发者面临的五类障碍与底层 API 同高层任务间的可用性鸿沟。
以太坊为智能合约提供椭圆曲线运算等底层密码学 API，但开发者并非密码学专家，直接使用这些原语引发了真实安全问题和可用性挑战。本文开展首个以太坊密码学实践的实证研究，分析 9800 余万笔交易、500 个密码学相关合约和 483 条 StackExchange 帖子，刻画开发者需完成的密码学任务并归纳出五类障碍；进而对 78 位从业者开展在线调查，探究障碍成因。研究发现超过半数从业者在密码学任务上比一般业务逻辑面临更多挑战，反馈凸显底层 API 与高层任务间的鸿沟，呼吁改进 API、提供任务模板与辅助工具。论文据此给出实践启示与未来方向。
To empower smart contracts with the promising capabilities of cryptography, Ethereum officially introduced a set of cryptographic APIs that facilitate basic cryptographic operations within smart contracts, such as elliptic curve operations. However, since developers are not necessarily cryptography experts, requiring them to directly interact with these basic APIs has caused real-world security issues and potential usability challenges. To guide future research and solutions to these challenges, we conduct the first empirical study on Ethereum cryptographic practices. Through the analysis of 91,484,856 Ethereum transactions, 500 crypto-related contracts, and 483 StackExchange posts, we provide the first in-depth look at cryptographic tasks developers need to accomplish and identify five categories of obstacles they encounter. Furthermore, we conduct an online survey with 78 smart contract practitioners to explore their perspectives on these obstacles and elicit the underlying reasons. We find that more than half of practitioners face more challenges in cryptographic tasks compared to general business logic in smart contracts. Their feedback highlights the gap between low-level cryptographic APIs and high-level tasks they need to accomplish, emphasizing the need for improved cryptographic APIs, task-based templates, and effective assistance tools. Based on these findings, we provide practical implications for further improvements and outline future research directions.
@inproceedings{paperbot11460,
title = {When Contracts Meets Crypto: Exploring Developers' Struggles with Ethereum Cryptographic APIs},
author = {Jiashuo Zhang and Jiachi Chen and Zhiyuan Wan and Ting Chen and Jianbo Gao and Zhong Chen},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639131}
}