A Deal with the Devil:

Breaking Smart Contracts
David Wong, Mason HemmelHistory•

2009 - Bitcoin•

2014/2015 - Ethereum

Ethereum is a computer— Gavin Woodwhat are
smart contracts?

what are
smart contracts
used for?

IPO

IPO
ICO

withdraw()

msg.sender

DAO

withdraw()

msg.sender

DAO

withdraw()

msg.sender
is asmart contract

DAOattack()

msg.sender
is asmart contract

withdraw()

DAO

withdraw()
fallback()

msg.sender
is asmart contract

DAOsmartcontract

smart contract
smart
contract

smart contract
smart
contract

smart
contract

smart
contractwithdraw()
fallback()

msg.sender
is asmart contract

DAOwithdraw()
withdraw()
fallback()
fallback()

msg.sender
msg.senderisisaasmartcontract
contract
smart

DAO
DAO

withdraw()
withdraw()
fallback()
fallback()

msg.sender
msg.senderisisaasmartcontract
contract
smart

DAO
DAO

withdraw()
fallback()

msg.sender
is asmart contract

DAOwithdraw()
withdraw()
withdraw()
fallback()
fallback()

msg.sender
msg.sender
msg.senderisisisaaa
smartcontract
contract
smart
contract

DAO
DAODAO

withdraw()
fallback()

msg.senderis asmart contract

DAO

Reentrancy
Race-to-empty••

Sending ether to an address might lead to code execution
Changing the state after calling another contract

Wallet
function initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

Walletfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•owners: David, Mason and Thomasrequired: 2

Wallet•function() { … }WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

Wallet•function() { … }Wallet•function() { … }WalletWalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …

•

function() { … }•Wallet•function() { … }Wallet•function() { … }WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

call: initWallet()owners: David, Mason and Thomasrequired: 2

Wallet•function() { … }delegateCall

WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

call: initWallet()owners: David, Mason and Thomasrequired: 2

Walletowners: David, Mason, Thomas• function() { … }•WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

Walletowners: David, Mason, Thomas• function() { … }•delegateCall

WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

call: initWallet()owners: Eve
required: 1

Walletowners: Eve• function() { … }•WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

Part 2: Electric BoogalooWallet•function() { … }WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•

Wallet•function() { … }WalletLibraryfunction initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)
• …
•owners: devops199
required: 1

Wallet•function() { … }WalletLibraryowner: devops199• function initWallet(address[] _owners, …)• function confirm(bytes32 _h)• function kill(address _to)•Other vulnerabilities

Randomness
Nothing is secretNOTHING IS SECRETattack()

isblockhashofblock.numbereven?

play()

Gameattack()

isblockhash
ofblock.numbereven?

play()

Gameattack()

isblockhash
ofblock.numbereven?

play()

Game

block.timestamp• Using the Timestamp has the same issue, also miners can influence itRandomness
Nothing is secret• Be wary of ”randomness”• Strong reliance on time is badFront-runningalso known as race condition, TOCTOU, TOD

AliceBobsolutionplay()

Game

Alicesolutionplay()

niotulso

BobGameAlicesolutionplay()

niotulso

BobGameFront-runningalso known as race condition, TOCTOU, TOD••

Can transactions re-ordering strongly affect the outcome?
Do some transactions contain secret information?

Arithmetic Errors

Integer overflows and underflows

uint81 1 1 1 1 1 1 1+10 0 0 0 0 0 0 0https://github.com/trailofbits/not-so-smartcontracts/blob/master/integer_overflow/interger_overflow_1.sol

What to Look For• Unchecked arithmetic operation• Can be increased/decreased by large enough leaps (incrementing
upward generally too expensive)• Accessible from lower levels of privilege

Denial of Service

manycontributions

pay out pls

play() {add_user()}

payToAllUsers() {for user in users}too manycontributions

pay out pls

play() {add_user()}

payToAllUsers() {for user in users}

But Wait—There’s More!

DavidpayBackBids()

Masonvictim
smart contract

function() {revert();}Intro to Accounting for
Solidity Programmers

What to Look For• For loops dependent on storage values• Functions dependent on transactions• Public functions affecting contract balanceMethodology Takeaways• Prerequisite: knowledge of common Ethereum gotchas• Understand the contract• Look for•
••
•
•
•

Calls to external contracts and low level function calls
Denial of Services
Reliance on public or secret values
Logic relying on user input
Re-inventing the wheel
Excessive use of inline assembly• Analyze any publicly-accessible functions in depthTools• Oyente, Mythril, Manticore, …
• Run them in the beginning, but don’t expect much unless there
is an evident issue• Remix and Linters• really useful to catch quick mistakes and bad behaviors thatmight lead to issues. Awesome to test and debug quickly.
• Truffle:• is OK• Disassembler and decompilers

Future•
••
•
•
•
•

Formal verification
Frameworks and re-usable code
Ethereum rapidly evolves
Solidity, Mist, Ethereum Wallet still have experimental versions.
Audit process is immature
Lots of money put in lightly-audited smart contracts
Unknown unknowns ?

the decentralized application security project:www.dasp.co
follow us on
twitter.com/cryptodavidw
twitter.com/mah3mm(we work here)