Exploring Security Vulnerabilities in Competitive Programming: An Empirical Study

Insecure code leading to software vulnerabilities can result in damages of the order of millions of dollars, and in critical systems, the loss of life. Hence, developing secure systems free of exploitable vulnerabilities has been a thrust area of research in recent years. Understanding developers’ approach towards vulnerabilities in their code can pave the way for improvements in insecure coding practices. Recent studies have explored online Q&A forums, open-source code repositories, and other code information sources to gain important insights into the pervasiveness of security vulnerabilities. However, to the best of our knowledge, competitive programming (CP) data, a rich source of information about coding practices, has not been explored from the perspective of insecure coding practices. The evaluation and assessment of coding practices used in CP is particularly intriguing because it has become a key player in developer recruitment in recent times. In this paper, we make one of the first attempts to draw the attention of the community to the emergent concern of insecure coding practices in CP. We use static analysis tools to identify the prevalence and nature of vulnerabilities in a large amount of CP data (6.1 million submissions) obtained from a top-rated CP platform, CodeChef, and find that 34.2% of submissions contain vulnerabilities. We observe that many programmers consistently follow insecure coding practices and most of the detected vulnerabilities are characterized by security standards (CWE, CVSS) based on real-world software.