Understand the trending of newly-uploaded smart contracts that is considered as vulnerable

Question

We tried to use Oyente to analyze some online contracts and drawed a diagram regarding the potentially vulnerable smart contracts ("reentrancy" bug) with respect to their creation time.

So the y-axis is calculated by compute the following percentage:

# of vulnerable contracts / 300

we randomly select 300 contracts within each period.

The overall trending keeps decreasing, which indicates people's awareness of reentrancy bug and are using more secure design strategies when writing new smart contracts. This makes a lot of sense to us.

However, as you can see, at 2016-10 and 2017-11, the number of "vulnerable" smart contracts have a big drop. This is something we cannot interpret. We are aware that the infamous DAO bug is reported in 2016-07, then potentially make developers more cautious during that period? But why 2016-11 and 2016-12 seems to have a much higher percentage of vulnerable contracts?

Answer 1

A few ideas, but nothing concrete. Might be verging on the speculative...

---

we randomly...

How? Are you using a source that lists all contracts deployed in the time period?

Or are you just looking at contracts that use the transfer/withdraw pattern, and checking what proportion of those contains a reentrancy vulnerability?

If you're using a sample from all contracts, couldn't it just be chance that you haven't selected those which actually contain a transfer/withdraw code pattern? (In which case there would be no chance of finding the vulnerability.)

...select 300 contracts within each period.

Is that a big enough sample size to rule out your results being statistical anomalies? Do you get the same results if you repeat with a much larger sample size?

The overall trending keeps decreasing, which indicates people's awareness of reentrancy bug and are using more secure design strategies when writing new smart contracts.

The other way to look at this is to speculate that the number of new users being on-boarded who don't know what they're doing would outweigh the number of existing user who've become better programmers. :-)

What's perhaps more likely is that people - including new users - are using stock contract templates from groups like Open Zeppelin, which are already audited for various common bugs. And this isn't necessarily because they're prudent programmers aware of attack vectors; it could just be that they're lazy and don't want to do the work.

A few other ideas that I haven't looked into:

• When did groups like Open Zeppelin start making audited contract templates available? (This probably wouldn't explain a temporary dip, though.)
• Is anything interesting happening in the network as a whole during those time periods? (Etherscan's charts might be useful here: https://etherscan.io/charts)