GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts

Abstract

GoLiSA is a static analysis tool that allows the verification of smart contracts written in Go, the most widely used language for developing smart contracts in Hyperledger Fabric. GoLiSA relies on abstract interpretation to model program semantics and identify potential risks and vulnerabilities in smart contracts. It supports advanced analyses such as information flow tracking and numerical and string value analysis, enabling the approximation of semantic program behaviors. Building on these analyses, GoLiSA implements a suite of checks for detecting non-trivial issues and potential risks in Hyperledger Fabric, including non-determinism, phantom reads, untrusted cross-contract invocations, read-after-write and over-write issues, cross-channel invocation risks, numerical issues, and unhandled errors. GoLiSA is publicly available at https://github.com/lisa-analyzer/go-lisa. A demonstration video showcasing the tool is available at https://youtu.be/WqkYOpWc9oE.