  Context: Smart contracts are computer programs that are automatically
executed on the blockchain. Vulnerabilities in their implementation have led to
severe loss of cryptocurrency. Smart contracts become immutable when deployed
to the Ethereum blockchain. Therefore, it is essential to understand the nature
of vulnerabilities in Ethereum smart contracts to prevent them in the future.
Existing classifications exist, but are limited in several ways. Objective: We
aim to characterize vulnerabilities in Ethereum smart contracts written in
Solidity, and unify existing classifications schemes. Method: We extracted 2143
vulnerabilities from public coding platforms and popular vulnerability
databases and categorized them using a card sorting approach. We targeted the
Ethereum blockchain in this paper, as it is the first and most popular
blockchain to support the deployment of smart contracts, and Solidity as the
most widely used language to implement smart contracts. We devised a
classification scheme of smart contract vulnerabilities according to their
error source and impact. Afterwards, we mapped existing classification schemes
to our classification. Results: The resulting classification consists of 11
categories describing the error source of a vulnerability and 13 categories
describing potential impacts. Our findings show that the language specific
coding and the structural data flow categories are the dominant categories, but
that the frequency of occurrence differs substantially between the data
sources. Conclusions: Our findings enable researchers to better understand
smart contract vulnerabilities by defining various dimensions of the problem
and supporting our classification with mappings with literature-based
classifications and frequency distributions of the defined categories.
