Potential Risks of Hyperledger Fabric Smart Contracts
Abstract
Blockchain is a decentralized ledger technology, and it is the technology underlying Bitcoin and Ethereum. The interest in blockchain has been increasing since its emergence. Hyperledger Fabric is one of the permissioned blockchain frameworks. One of the characteristics of Hyperledger Fabric is it utilizes general-purpose programming languages, e.g., Go, Node.js, and Java, to implement smart contracts (called chaincode in Hyperledger Fabric). The advantages of utilizing these languages are already known to potential developers, and development tools might already exist. However, one of the disadvantages is that these languages were not originally designed for writing smart contracts. Hence, there may be risks that developers do not need to consider when using specific languages such as Solidity of Ethereum. Furthermore, even though development tools exist, how many risks are covered by the tools is an open question. In this paper, we focus on Go language and the tools. First, we surveyed what kind of risks are associated with chaincodes are developed using Go language and observed there are 14 potential risks. Then, we investigated how many risks can be covered by Go tools, e.g., golint and gosec, and a vulnerability detection tool for chaincodes called Chaincode Scanner. From our results, we observed that some risks are not covered by the existing tools. Hence, we develop a detection tool to cover risks by static analysis. Finally, in this paper, we describe how to find the risks with our tool and evaluate the usefulness.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
P-ABC implementations such as IBM's Identity Mixer and Microsoft's U-Prove have not had the expected adoption rate.
“Implementations such as IBM's Identity Mixer [21], [22] or Microsoft's U-Prove [23] have not had the expected adoption rate.”
From A Trusted Approach for Decentralised and Privacy-Preserving Identity Management (2021) · cites this paper as [23]
Cites
Blockchains and smart contracts for the internet of things
Christidis, K., & Devetsikiotis, M. (2016) · IEEE Access · doi:10.1109/access.2016.2566339 · Cited by 4,552 · see citing works
Performance Benchmarking and Optimizing Hyperledger Fabric Blockchain Platform
Thakkar, P., Nathan, S., & Viswanathan, B. (2018) · 2018 IEEE 26th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) · doi:10.1109/mascots.2018.00034 · Cited by 632 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Trusted Approach for Decentralised and Privacy-Preserving Identity Management
Moreno, R. T., Garcia-Rodriguez, J., Bernabe, J. B., & Skarmeta, A. (2021) · IEEE Access · doi:10.1109/access.2021.3099837 · Cited by 33 · see citing works
“Works such as Brotsis et al. [48], Andola et al. [49], Yamashita et al. [50], and Dabholkar et al. [51] have already dealt with security analysis of HLF, including common attacks and problems (i.e., DDoS attacks, double registration problem or tampering), structural challenges and possible problems…”
Background
- Authors
- Yamashita, K., Nomura, Y., Zhou, E., Pi, B., & Jun, S.
- Affiliations
- Fujitsu (Japan) (JP)
- Fujitsu (China) (CN)
- Venue
- 2019 IEEE International Workshop on Blockchain Oriented Software Engineering (IWBOSE)
- Publisher
- IEEE
- Published
- 2019-02
- Pages
- 1-10
- OpenAlex
- W2920932783
- Cited by
- 131
- References
- 2
- Citations by year
- 2026: 3 · 2025: 8 · 2024: 16 · 2023: 27 · 2022: 27 · 2021: 26 · 2020: 20 · 2019: 4
- FWCI
- 15.33
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE International Workshop on Blockchain Oriented Software Engineering (IWBOSE) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Artificial Intelligence › Logic, programming, and type systems
- Keywords
- Hyperledger Fabric, smart contracts, chaincode, Go programming language, permissioned blockchain, vulnerability detection, static analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
