POSTER: An Empirical Study of Smart Contract Patching Practices in the Wild

Smart contract vulnerabilities pose significant financial risks, making their detection and remediation critical before deployment. While numerous vulnerability detection tools exist, limited empirical research examines how smart contract vulnerabilities are patched and maintained in practice. To address this gap, we conducted a comprehensive analysis of patch management practices across smart contract ecosystems. Our study examined 4,345,088 smart contracts and identified 8,727 vulnerable contracts via an automated detection tool and 4,399 through user reports. Smart contract development practices widely acknowledge that vulnerable contracts should be destroyed and redeployed with appropriate fixes. However, we found that only 248 user-reported vulnerable contracts were self-destructed and only 6.85% of them were redeployed following destruction. Furthermore, these redeployed contracts still contained vulnerabilities, indicating ineffective patch implementation. These findings reveal significant shortcomings in current smart contract maintenance practices and highlight the need for improved security patch management protocols.