  Smart contracts are self-executing programs that run on blockchains (e.g.,
Ethereum). 680 million US dollars worth of digital assets controlled by smart
contracts have been hacked or stolen due to various security vulnerabilities in
2021. Although security is a fundamental concern for smart contracts, it is
unclear how smart contract developers approach security. To help fill this
research gap, we conducted an exploratory qualitative study consisting of a
semi-structured interview and a code review task with 29 smart contract
developers with diverse backgrounds, including 10 early stage (less than one
year of experience) and 19 experienced (2-5 years of experience) smart contract
developers.
  Our findings show a wide range of smart contract security perceptions and
practices including various tools and resources they used. Our early-stage
developer participants had a much lower success rate (15%) of identifying
security vulnerabilities in the code review task than their experienced
counterparts (55%). Our hierarchical task analysis of their code reviews
implies that just by accessing standard documentation, reference
implementations and security tools is not sufficient. Many developers checked
those materials or used a security tool but still failed to identify the
security issues. In addition, several participants pointed out shortcomings of
current smart contract security tooling such as its usability. We discuss how
future education and tools could better support developers in ensuring smart
contract security.
