DAPPCON 2024:Analysing Live Smart Contract Systems:Discovery And Update Monitoring- Piotr Szlachciak

Transcript

okay hello everyone um welcome to this wonderful talk we have a great audience this evening and I know a lot of you are also watching on YouTube so uh welcome uh today I'm going to talk about analyzing live smart contract systems and how we do it at L2 beat and my name is p schack I'm the C CEO and co-founder of L2 beat and if you don't know L2 beat well we are doing research and analytics about ethereum l2s and if you would like to like have some context to what I'm talking about open up our web page do some browsing and uh you'll you'll see

what what the talk is about and now I'm going to State the problem that we Face we are listing more than a 100 projects right now and this is across l2s l3s Bridges we're we're analyzing all of them and by analyzing I mean not only like displaying tvl but we actually do indepth research about those projects we look at the Smart contracts we look at the upgradeability the security guarantees and uh we would like our information on the website to be up to date now this is a challenge because uh if we make some simple assumptions so we have 100 projects let's assume every project doesn't upgrade every 6 months

right so like uh usual cycle they do the marketing they do the preparation Audits and so on every 6 months they release a new version so what this gives us 100 projects two updates per year 200 updates per year so we have four updates per week and in reality right we actually see changes happen every single day so obviously uh this is unsustainable if we wanted to do this manually we tried this at the start we we had very little projects and it was possible to like sit down uh do the research very manual work look at the Smart contract try to get the sense of

how it all works and then like do a write up and it would essentially um come down to like uh presenting our findings on on the website now if we would continue this process it would actually like be completely unsustainable because of all of those upgrades the moment we publish the information it like instantly becomes stale because one of the projects upgrades and like so we had to come up with a solution and the solution is of course automation so but the the the key insight into all of this is is how can you do this right because it's not just like downloading values from an

RPC you you can use an RPC for things like tvl because you just select the tokens that you want to know about and you query the balance off function you cannot do this for research and so we had to be clever now we designed a system that we call Discovery and this is a system that does recursive scanning and Analysis of smart contract systems and I think I think the best way is to show you an example so an example that I picked is actually signups and the reason I picked signups it's a bridge is because the smart contract architecture is actually really simple compared to some other projects and the way uh you can start to think about what we do is starting on the left

we have the signups Bridge smart contract and in the smart contract we can see uh that it has some Fields right it has an admin field it has an address of the wrapped ether smart contract it has some Access Control pattern and so you can see that then the admin is read by our system and we see that it points to the proxy admin smart contract then the proxy admin has an owner which is the time lock controller and the time lock controller has an admin which is the bridge multisig and this is actually the controller of the entire system and we were able to draw this diagram through using our Discovery tooling that uh recursively as I said goes through

the uh the smart contracts calls the methods gets the values and and Maps the entire system and I think it's also time for a demo of how it works so what I have prepared here is a very minimal setup that uh will'll try to uh like do the work that the researchers are doing normally so what we have here is a minimal like config file for using Discovery our Tool uh to do this mapping of the signup system the initial address this uh Ox 2796 right is the address of the signups bridge and so what we're going to do is just say we want to discover on the Chain

ethereum um the bridge signups and we're going to run this script and I'm I'm just going to show you the output because it's very fast but we're analyzing the smart contract and what we see is we have detected it's actually a proxy right so now we actually uh read the implementation and the implementation has some uh some methods we call those methods and we have this new relatives found right I know that one of this is the address of the WRA ether smart contract and the other is the proxy admin so you can see then then we we're analyzing the r ether and then the proxy admin and and we have

this recursive uh recursive thing where we just query the the values for all the smart contracts now then the researcher would go into this other file this is the discovered Json file so the config produces the discovered file and here you can see the exact stuff that I was talking about the the values that were discovered the recursive method and we can see uh some values like default admin Ro governance role node group role the re researcher and I will know that this is actually reminiscent of a pattern that you can find in open Zeppelin smart contracts called access control and the cool thing about the discovery tool is that it actually allows you to incorporate some of the knowledge that you have about the smart

contracts and automate getting those values so what we're going to do is do some overrides and we're going to say that for this smart contract it has we want to override some Fields we're going to add a field called access control and this field is going to have a Handler so we're specifying now what what are we going to do uh how are we going to get the value of this field and similarly we can see that the time loog controller also has those roles so we're going to use the address of the time loog controller and and we're going to add the exact same overrides for the time loog

controller so now that we've done that if we run our Discovery again it uh is going to discover some more stuff so now you can see that the signups Bridge has this Access Control field and it has those roles fetched from the uh from the blockchain so this is kind of how a researchers would work would use the discovery tool and the cool thing about it is now we can also get the source code of those smart contracts so in the code folder are the source codes for all of the smart contracts that we have downloaded from ether scan so you can see the signups bridge and because it's a proxy we have

the source code of the proxy and we have the source code of the implementation now looking at this you can see that it's so like a lot of folders lot of files lot of comments it's like very overwhelming how are we going to read all of this and this is where the next part comes in which is we're not the best part is it's all automatically flattened into a single file we remove the unused stuff so that it's very easy for a researcher to actually read the source code so now instead of having those two folders the implementation and proxy and all of those have nested folders and you're going to try to figure out what's what if I open the signups Bridge uh folder in the

flattened file I have the source code for the signups bridge and it's only the stuff that is actually used and have the source code for the proxy again only the stuff that is actually used so as a researcher I would only look at those so I don't have to uh do this thing where I go to E scan and browse through those 65 files and like in this very bad UI um so that's uh that's it for the demo and if we go back to the presentation what's the logical next thing now that we have the ability to do automated research and getting all those values and and being able to configure how we get those values well the next

logical thing is to run it in a loop and so we run it in a loop and every hour we go through all of the projects that we have configured we get all of those values and we compare it to what came an hour before and so this is an example from uh today early in the morning a chain called Dairy had an upgrade um and they Chang the required stake from two to three right um so this is this is the type of thing that we detect and then the next logical thing is we can automatically update our website so whenever whenever things change um we can so for example you can see here this is uh an excerpt from our web page for arbitrum and you can see the security

ccil participants right if someone were to add people there remove people there this probably doesn't affect the security of the system this probably doesn't require a human to go in and like write something specific about how the system works now it's a simple change so those changes can be automatically reflected in the website and for for more complex changes let's say that the implementation changes for some of the contracts um we just say Okay this system is now under review and one of our researchers sits down and actually runs the discovery locally reads the source code and figures out what has changed and actually the the one other thing that I wanted to show you uh so we we'll go back to the code

right is is the ability to figure out what has actually uh changed and I think it's best if I show you this on on a different example what I'm going to do is show you how we can compare projects to each other so you might have heard about optimism and super chain and op stock chains and you might think okay so those OP stock chains are basically all the same right um well no and I'm going to show you uh one example so what we're going to do is we're going to run a tool called Power diff so Discovery was one thing power diff is another thing but basically it allows you to compare two

projects together right and uh I'm going to pick um base as uh one of the projects and the other project is going to be mantle and uh so I'm going to run the power diff it's going to process the files that that I have and it's going to it's going to open this um this uh like web page and so now I can browse through the files some of them are added some of them them are deleted some of them have actual differences and so I can I can choose a file to like look into and for example the difference between base and and mantle in one of the files like the L2 output Oracle is that one of the

system has those value and mint variables and the other has like mint value and if value right so so there are there are differences that we can pick up on using using the research tools that we have built and this is how we can actually know oh like what did they do when they when they deployed the projects so coming back to the presentation um we have some Advanced features built into this entire tooling like I showed you code flattening I showed you handlers I showed you project comparisons I haven't showed you uh but I I'll talk about the heuristics and templates so you might think uh okay that's all well and good but I have to

like create config files for all the projects and I kind of have to repeat the research what if the projects are similar uh and this is what we actually find that a lot of projects are reusing the same patterns the same the same things so this is where heuristics and templates come in for example a lot of projects use the same proxy types right so as as you've seen before we can automatically detect that a smart contract is a proxy this is what we're using heuristics for one example would be how do we know a smart contract is a nosis safe uh well the way we do it is we actually check if the value at storage slot zero is equal to the same value that is returned from the call to

the Master Copy function it's an example of heuristic and this is how we detect no smart contracts if we have a huge list of those heuristics this is how we can detect different types of contracts and for the templates basically um these configuration files that you saw before you can reuse them uh for for different projects and this reusing is is templates but also when we Define projects on our website uh we can reuse the definition so all op stock chains are kind of reusing the same template so that the researchers don't have to do as much work when when they describe it and and this kind of solves the the problem that I stated at the at the beginning

which is we have all those projects how can we manage the constant updates the the the flow of of everything and and now let let me talk about something that is like coming up that's not yet really built but but that that's being built right now is automatic detection of project permissions so the this is again an excerpt uh from from L2 be's website these are the permissions in the um optimism uh blockchain and what you can see is that uh it's kind of hard to to see what's going on we have the proxy admin we have the proxy admin owner the the proxy admin owner multisig and this multisig is actually two multisig the

foundation and the security Council and I know this but it's not easily readable from here and I was thinking maybe we can change the format to sort of say these are the entities that have control of the system and and going through the entities we show what they can do uh and also uh we are building this in an automated way so again not to overburden the researchers uh once the system detects that oh there is some owner of the smart contract it it it gets automatically assigned as this entity that we want to list in this in this permissions so this is what's coming in the future with this tooling and and it basically allows us to keep up hopefully

with the constant flow of new projects that are coming and so I guess it's time for me to say thank you and if you have any questions I'll be I'll be happy to answer them okay we have one question thank you much sorry we missed the beginning maybe you mentioned it this is tooling is it open source and available yes yes so this tooling is open source it's part of the al2 beat repository but open source doesn't exactly mean easy to use outside Al to beat um so you can read the source code you can see how we're doing it uh but I think you'll find it quite hard to run it for your own things uh but I

encourage you to do I'll try it we have a few targets we we need to to test and I had a second question how many researchers do you have at l2b currently currently we have four research the this is the size of our research team okay great thank you thank you okay do we have any more questions okay then thank you very much you have been a wonderful audience and uh yeah thank you