A COMPARATIVE STUDY OF SMART CONTRACT PROGRAMMING LANGUAGES: SECURITY, PERFORMANCE, AND OPTIMIZATION TRADE-OFFs

Öz

Smart contracts have become a fundamental component of blockchain ecosystems, and their reliability is strongly shaped by the programming languages in which they are written. While prior studies have classified vulnerabilities, fewer have quantitatively examined how language design and secure coding practices affect performance and resilience. To address this gap, this study empirically compares Solidity and Vyper under controlled conditions and complements these experiments with a literature-based evaluation of Rust and Move. Test scenarios included deployment, deposits, withdrawals, arithmetic overflow, reentrancy, and transaction origin misuse. For both vulnerable and secure variants in Solidity and Vyper, metrics such as gas consumption, deployment size, and runtime execution time were collected. The results indicate that deployment costs differ substantially between the two languages (Solidity ≈ 177 k gas vs Vyper ≈ 135 k gas, ~24% lower), whereas runtime performance is mixed: deposit calls are nearly identical (Δ ≈ 0.02 ms), whereas withdraw shows a noticeable gap (Δ ≈ 4.97 ms) favoring Vyper; nevertheless, these call-level differences remain small relative to the larger deployment-time gap. Importantly, secure coding practices such as explicit arithmetic checks and the Checks–Effects–Interactions pattern eliminate critical vulnerabilities while adding less than 1% to the overall execution cost. Although Rust and Move are considered through a literature-based review, they illustrate alternative approaches that embed security guarantees directly into the language. Based on these observations, this study proposes a measurable framework to understand how different smart contract programming languages vary in terms of security and efficiency, emphasizing the role of language design and secure coding practices in shaping contract development.

Anahtar Kelimeler

• Blockchain Security
• Comparative Benchmarking
• Secure Coding
• Smart Contracts.

AKILLI SÖZLEŞME PROGRAMLAMA DİLLERINİN KARŞILAŞTIRMALI İNCELEMESİ: GÜVENLİK, PERFORMANS VE OPTİMİZASYON DENGELERİ

Öz

Akıllı sözleşmeler, blok zinciri ekosistemlerinin temel bir bileşeni haline gelmiş olup, güvenilirlikleri büyük ölçüde yazıldıkları programlama dilleri tarafından şekillendirilmektedir. Önceki çalışmalar zafiyetleri sınıflandırmış olsa da, dil tasarımı ve güvenli kodlama uygulamalarının performans ve dayanıklılık üzerindeki etkilerini nicel olarak inceleyen araştırmalar daha sınırlıdır. Bu boşluğu gidermek amacıyla, bu çalışmada kontrollü koşullar altında Solidity ve Vyper dillerini deneysel olarak karşılaştırılmakta ve bu deneyler Rust ve Move dillerine ilişkin literatür temelli bir değerlendirme ile tamamlanmaktadır. Test senaryoları; dağıtım, para yatırma, para çekme, aritmetik taşma, yeniden giriş (reentrancy) ve işlem kaynağı kötüye kullanımı gibi durumları içermektedir. Solidity ve Vyper’ın hem zafiyetli hem de güvenli sürümleri için gaz tüketimi, dağıtım boyutu ve çalışma zamanı yürütme süresi gibi metrikler toplanmıştır. Sonuçlar, iki dil arasında dağıtım maliyetlerinin önemli ölçüde farklılaştığını (Solidity ≈ 177k gas, Vyper ≈ 135k gas, yaklaşık %24 daha düşük) gösterirken, çalışma zamanı performansının karma olduğunu ortaya koymaktadır: deposit çağrıları neredeyse aynıdır (Δ ≈ 0.02 ms), buna karşın withdraw çağrısında belirgin bir fark vardır (Δ ≈ 4.97 ms) ve Vyper lehinedir; yine de bu çağrı düzeyi farkları, dağıtım zamanındaki daha büyük farka kıyasla küçüktür. Ayrıca, açık aritmetik kontrolleri ve Checks–Effects–Interactions modelinin uygulanması gibi güvenli kodlama uygulamaları, kritik zafiyetleri ortadan kaldırırken toplam yürütme maliyetine %1’den daha az ek yük getirmektedir. Rust ve Move her ne kadar bu çalışmada literatür temelli olarak ele alınmış olsa da, güvenlik garantilerini doğrudan dile entegre eden alternatif yaklaşımları örneklemektedir. Bu gözlemlerden hareketle, bu çalışma; farklı akıllı sözleşme programlama dillerinin güvenlik ve verimlilik açısından nasıl farklılaştığını anlamaya yönelik ölçülebilir bir çerçeve önermekte ve dil tasarımı ile güvenli kodlama uygulamalarının sözleşme geliştirme sürecini nasıl şekillendirdiğini vurgulamaktadır.

Anahtar Kelimeler

• Akıllı Sözleşmeler
• Blok Zincir Güvenliği
• Güvenli Kodlama
• Karşılaştırmalı Performans Ölçümü.

Kaynakça

1. Aptos Labs. (2025). Move - A Web3 Language and Runtime. Retrieved September 10, 2025, from https://aptos.dev/network/blockchain/move.
2. Atzei, N., Bartoletti, M., & Cimoli, T. (2017). A survey of attacks on Ethereum smart contracts (SoK). Principles of Security and Trust (POST), LNCS, 10204, 164–186. Springer.
3. Bartoletti, M., Galletta, L., & Murgia, M. (2021). A theory of transaction parallelism in blockchains. Logical Methods in Computer Science, 17(4), 1–41.
4. Bartoletti, M., Fioravanti, F., Matricardi, G., Pettinau, R., & Sainas, F. (2024). Towards benchmarking of Solidity verification tools. Workshop on Formal Methods for Blockchains (FMBC 2024), OASIcs.
5. Bartoletti, M., Benetollo, L., Bugliesi, M., Crafa, S., Dal Sasso, G., Pettinau, R., Pinna, A., Piras, M., Rossi, S., Salis, S., Spanò, A., Tkachenko, V., Tonelli, R., & Zunino, R. (2025). Smart contract languages: A comparative analysis. Future Generation Computer Systems, 164, 107563.
6. Blackshear, S., Cheng, E., Dill, D. L., Gao, V., Maurer, B., Nowacki, T., ... & Zhou, R. (2019). Move: A language with programmable resources. Retrieved September 7, 2025, from https://developers.diem.com/papers/diem-move-a-language-with-programmable-resources/2019-06-18.pdf.
7. Buterin, V. (2014). Ethereum white paper: A Next Generation Smart Contract & Decentralized Application Platform. Retrieved September 10, 2025 from https://ethereum.org/content/whitepaper/whitepaper-pdf/Ethereum_Whitepaper_-_Buterin_2014.pdf
8. Besbas, A., Ailane, A., Kahloul, L., Slatnia, S., & Bourekkache, S. (2024, November). On the formal verification of smart contracts and blockchain: Challenges and future directions. In 2024 4th International Conference on Embedded & Distributed Systems (EDiS), 213-217. Catalini, C., Gratry, O., Hou, J. M., Parasuraman, S., & Wernerfelt, N. (2019). The libra reserve. Libra White Paper.

9. Chen, T., Li, X., Wang, Y., Chen, J., Li, Z., Luo, X., Au, M. H., & Zhang, X. (2017). An adaptive gas cost mechanism for Ethereum to defend against under-priced DoS attacks. In Information Security Practice and Experience (ISPEC 2017), 3–24. Springer.
10. Crafa, S., Di Pirro, M., & Zucca, E. (2019). Is Solidity solid enough? In Financial Cryptography Workshops (LNCS 11599, pp. 138–153). Springer.
11. Cui, S., Zhao, G., Gao, Y., Tavu, T., & Huang, J. (2022). VRust: Automated vulnerability detection for Solana smart contracts. In Proceedings of the 2022 ACM CCS (pp. 639–652). ACM.
12. Dannen, C. (2017). Introducing Ethereum and Solidity: Foundations of cryptocurrency and blockchain programming for beginners. Apress.
13. Durieux, T., Ferreira, J. F., Abreu, R., & Cruz, P. (2020, June). Empirical review of automated analysis tools on 47,587 Ethereum smart contracts. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering (pp. 530-541).
14. Ethereum Foundation. (2017). Vyper: Pythonic smart contract language. Retrieved September 5, 2025, from https://vyper.readthedocs.io
15. Garfatta, I., Klai, K., Gaaloul, W., & Graiet, M. (2021). A survey on formal verification for Solidity smart contracts. In Proceedings of the Australasian Computer Science Week (ACSW ’21) (pp. 1–10). ACM.
16. Hu, B., Zhang, Z., Liu, J., Liu, Y., Yin, J., Lu, R., & Lin, X. (2021). A comprehensive survey on smart contract construction and execution: Paradigms, tools, and systems. Patterns, 2(2), 100179.
17. Hewa, T. M., Hu, Y., Liyanage, M., Kanhere, S. S., & Ylianttila, M. (2021). Survey on blockchain-based smart contracts: Technical aspects and future research. IEEE Access, 9, 87643–87662.
18. Ivanov, N., Li, C., Yan, Q., Sun, Z., Cao, Z., & Luo, X. (2023). Security threat mitigation for smart contracts: A comprehensive survey. ACM Computing Surveys, 55(14s), 326:1–326:37.
19. Kaleem, M., Mavridou, A., & Laszka, A. (2020, September). Vyper: A security comparison with Solidity based on common vulnerabilities. In 2020 2nd conference on blockchain research & applications for innovative networks and services (BRAINS) (pp. 107-111). IEEE.
20. Kushwaha, S. S., Joshi, S., Singh, D., Kaur, M., & Lee, H.-N. (2022). Ethereum smart contract analysis tools: A systematic review. IEEE Access, 10, 57037–57062. Luu, L., Chu, D., Olickel, H., Saxena, P., & Hobor, A. (2016). Making smart contracts smarter. In Proceedings of the 2016 ACM CCS (pp. 254–269). ACM.
21. Matsakis, N. D., & Klock, F. S. (2014). The Rust language. ACM SIGAda Ada Letters, 34(3), 103–104.
22. Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. Retrieved September 7, 2025, from https://bitcoin.org/bitcoin.pdf.
23. Nishida, Y., Saito, H., Chen, R., Kawata, A., Furuse, J., Suenaga, K., & Igarashi, A. (2022). Helmholtz: A verifier for Tezos smart contracts based on refinement types. New Generation Computing, 40, 507–554.
24. Olivieri, L., Negrini, L., Arceri, V., Jensen, T., & Spoto, F. (2024). Design and implementation of static analyses for Tezos smart contracts. Distributed Ledger Technologies: Research and Practice, 2(2), 1–17.
25. Parizi, R. M., Amritraj, & Dehghantanha, A. (2018). Smart contract programming languages on blockchains: An empirical evaluation of usability and security. In ICBC 2018, 75–91. Springer.
26. Park, J., Zhang, T., Grieskamp, W., Xu, M., Di Giacomo, G., Chen, K., ... & Chen, R. (2024). Securing Aptos framework with formal verification. In 5th International Workshop on Formal Methods for Blockchains (FMBC 2024), 9-1. Schloss Dagstuhl–Leibniz-Zentrum für Informatik.
27. Perez, D., & Livshits, B. (2019). Broken metre: Attacking resource metering in EVM. arXiv preprint arXiv:1909.07220.
28. Qian, P., He, J., Lu, L., Wu, S., Lu, Z., Wu, L., Zhou, Y., & He, Q. (2023). Demystifying random number in Ethereum smart contracts: Taxonomy, vulnerability identification, and attack detection. IEEE Transactions on Software Engineering, 49(7), 3793–3810.
29. Rust Foundation. (2023). The Rust programming language (2nd ed.). Retrieved August 16, 2025, from https://doc.rust-lang.org/book/
30. Smolka, S., Giesen, J., Winkler, P., Draissi, O., Davi, L., Karame, G., & Pohl, K. (2023). Fuzz on the beach: Fuzzing Solana smart contracts. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS ’23),1197–1211. ACM.
31. Solidity Team. (2024). Solidity documentation. Retrieved September 2, 2025, from https://docs.soliditylang.org
32. Szabo, N. (1996). Smart contracts: Building blocks for digital markets. Extropy, 16(1), 18–23. Vacca, A., Di Sorbo, A., Visaggio, C. A., & Canfora, G. (2021). A systematic literature review of blockchain and smart contract development: Techniques, tools, and open challenges. Journal of Systems and Software, 174, 110891.
33. Varela-Vaca, Á. J., & Quintero, A. M. R. (2021). Smart contract languages: A multivocal mapping study. ACM Computing Surveys, 54(1), 1–38.
34. Voloder, A., & Di Angelo, M. (2023). Comparison of smart contract platforms from the perspective of developers. In International Conference on Blockchain. Springer. 104–118.
35. Wesley, S., Christakis, M., Navas, J. A., Trefler, R. J., Wüstholz, V., & Gurfinkel, A. (2022). Verifying Solidity smart contracts via communication abstraction in SmartACE. In VMCAI 2022 (LNCS) 13182, Springer, 425–449.
36. Wood, G. (2014). Ethereum: A secure decentralised generalised transaction ledger. Ethereum project yellow paper, 151(2014), 1-32.
37. Zheng, Z., Xie, S., Dai, H.-N., Chen, W., Chen, X., Weng, J., & Imran, M. (2020). An overview on smart contracts: Challenges, advances and platforms. Future Generation Computer Systems, 105, 475–491.
38. Zou, W., Lo, D., Kochhar, P. S., Le, X. D., Xia, X., Feng, Y., Chen, Z., & Xu, B. (2021). Smart contract development: Challenges and opportunities. IEEE Transactions on Software Engineering, 47(10), 2084–2106.