#DappCon22 : Day 2 - WTF Is My Smart Contract Doing: Understanding And Securing Tx With Truffle

Transcript

okay so next up we've got Emily Lin from truffle who's gonna do a talk about WTF is my smart contract doing understanding and securing transactions with truffle you're all set [Music] um okay cool I'm gonna get started so yes I am Emily I am the Truffle developer Advocate today I'm telling you how the fdu understands smart contracts and make sure you secure your transactions brief disclaimer before I start today I'm touching on all of our truffle tools

that you can use across all clis so if you're using hard hat Foundry whatever what I'm talking about today is going to be applicable to you so the first thing just kind of agenda of I have to fit 25 minutes in 20 minutes so we're not going to go over this agenda so we're just gonna start how the F do I read transactions so uh great job sourceify you just explained why this sucks um basically right now you know we need a decoder to understand this information the problems here is like call data we can't read like storage variables logs don't give us enough information we lose type information as well with like ethers you have like 128 versus 256.

another thing is like it's great we have verified Source contracts right so just knowing that Avi isn't good enough enough truffle decoder actually will go to either etherscan or sourceify get that verified contract information be able to I guess interpret the source code and give you more information that way and the last part is like either this isn't great either because it kind of breaks when there's malformed data so we need a solution that will kind of only show detailed error messages for the bad parts but work otherwise again all this sucks how do we fix it uh at truffle decoder so what is truffle decoder truffle decoder essentially transforms this uh hex data into machine

readable code so if you guys are familiar with metamask transaction insights this is actually powered by truffle decoder um uh this is again like I said usable by anybody it's just an npmi at truffle slash decoder the second big use case here that's really cool is the Truffle debugger I'm actually going to step into that after this so just to talk about uh oh I haven't done my live demo this is like also 25 minutes of me being crazy and doing live demos um so the first thing is like how does it work let me bring up the code uh I think I actually have it open cool so I'm going to start off with the most basic example so this is just retrieving information if you look through this guy

right here I'm just getting was it gets the provider transaction info right here specifically at truffle Fetch and compile I'm not going to touch on this but essentially this is a truffle function that will go fetch the source information from either etherscan or sourceify and then compile that down to be used in our decoder so after you do all of this what it should look like then for the most basic function is there's two forms it'll give it to you in so there's raw transaction data this is going to take some time but as you can see here it's pretty detailed you have the type information logs are down here I'm going to continue on with

the pretty print kind of version of it so um again blah blah blah hopefully this goes through um and yeah so again decoding that information this one's a little prettier it's easier to read I just pulled these random transactions off of etherscan so I don't really know where it's from um the second piece here is uh our decoder is I guess you could say intelligent if you see here there's this thing called interpretations so one thing I think that you know you should think about when decoding is thinking about common patterns uh so specifically in this one right here multi-call right so we have the multi-call standard where we have an array of by code so rather than just like saying like oh here's a

multi-call the decoder should intelligently go through each individual call and decode that call data itself right so as you can see here um in this I don't know what contract this was right but like it's making multiple retrieve reward calls and that is pretty cool and then the third piece that I think is really exciting about our decoder and the bane of my existence is celebrity maps are not innumerable right so how do you communicate that information so I'm going to go do this as well storage so the way the Truffle decoder works with storage variables is actually you need to define the keys that you are interested in and then pass that

information is that that's how our decoder will kind of understand uh how to I guess parse those mappings so if I go back it should be done as you can see here it's decoded this hex data into the storage variable and specifically I had called out owners balances token Uris so that is there um cool so I think that is all the stuff I have for Demos in terms of travel decoder what's next so like I said pattern recognition with multi-call uh the next step is proxy contracts right so what it would look like right now probably is you decode it and you'd see oh variable equals implementation contract uh our decoder should be intelligent enough to say hey look this

looks like a proxy contract let's actually go into the implementation contract and get that information as well the second piece here is actually kind of a custom resolver so you might have user-defined types like I said having the user be able to identify what does a pattern look like again putting the hands into being able to interpret data at a more custom level the second piece that we're working on as well is a library of react components so as I had shown before transaction insights it's just a react component like pulling in information from truffle decoder wouldn't be awesome if it does reusable components great and then the third piece is actually integrating it into truffle dashboard I will touch on truffle dashboard later in the

presentation but you can think of it as like integrating this Insight information into your normal development workflow and then I have the list of like docs just repo I will be sharing these slides afterwards so you can click on this link you don't have to remember this like 23b a53 uh if you want to look at the code so next piece what the f is going on in this contract so if you guys are solidity devs I think the worst experience at least in my opinion is testing specifically debugging right so what debugging looks like right now is basically console log I think that's the most popular way of doing it um you know for fast insights and Analysis is like specific variables you know console log is great I think

console log is really good for beginner devs right I mean like when I was in college I like when I tested things it was just print statement after print statement like I don't even know what a debugger is right but you know kanash does now support console log we have our own version npmi console log but if you just bring it up and connect it it will also respect hard hats console log as well as if you're using Viper Viper's print but like I said console log is not enough once you get into more complex use cases it's clunky it's manual again you don't have that wider context so you're kind of limited to whatever you decided to log and then the last piece is also it's like localized to your contracts right so if something is failing on mainnet for example console log is not going to help you there how

do we fix this problem um Tada truffle debug why is this awesome so travel debugger is actually kind of the debugger that you might know and love if you came from web 2 development specifically giving you things like step in step out you can set break points um variable analysis so that's going to pull things from variables that you step through as well as your storage variables at the top your state variables get some low-level byte code about a specific call in stack data the debugger comes in three different forms so this year we released our Visual Studio code debugger so if you're familiar with like the native debugger just like all in vs code and the IDE the CLI version is the original version and it is more feature robust it has if

you're looking to do like mainnet debugging for example that's going to be the CLI if you are interested in using the Truffle debugger with your hard hat project you will have to use the CLI we do not support it yet for the vs code extension and the last piece is in-test debugging so if you want to interrupt the middle of your test and say like hey I think this one's failing I just want to put like a debug wrapper kind of around it you can do that as well for your JavaScript tests your typescript test and then you can also write tests and solidity so let's go through some demos let's start off with ganache console log uh so let us pull it up actually before I start I'm gonna do this guy so as I

mentioned mainnet debugging how do you do that so if you can see right here oh where am I how do I open up my ganache and since cool so forking mainnet uh as you can see you can just Fork magnet with no uh zero config I specified the block number here um again for just like a random transaction I found on etherscan um unlock is another function that basically says I'm going to unlock this wallet to be used so you don't need private keys and you can mimic transactions through whoever actually deployed right um so just gonna go ahead and start this uh the next piece here is truffle debug so debug on its own is just going to do like local debugging fetch external is

what it's what's what it's going to do to go and grab uh information from etherscan sourceify like I had mentioned that truffle Fetch and compile um specifically here I'm specifying the network main net Dev just because I wanted to you don't have to so I'm going to hit enter um and we're going to come back to this because it is today where are we no cannot oh okay sorry that's because I'm not here what what's going on here you know what it's fine oh okay sorry I understand why I have the wrong port number here this is why I do it live so you if you make this mistake you're like wait let

me just watch this video Emily made the same thing um Okay cool so now this is actually going to be pulling in the information so this does take a little bit of time so we're gonna go back to what I was talking about with uh doing ganache so I'm going to pull up the Truffle no this is the wrong demo here we go um so this is a vs code extension um it'll pull up all of your information here on the side you can start ganache through the network you can start through CLI there's so many different ways you could do it I have it this way so if you want to take a look at our Marketplace contract basically all it is is an npm eye at ganache the squiggly line is here because the solidity

folder directory is confused but that's fine it still works I think I hope but anyways console log just what you know and love very simple so I'm just going to deploy through here I'm going to deploy it to this guy so I have um all of this up and cool now I'm here I'm going to do a couple console specifically looking at that Network that I just deployed to um what was I doing uh let's mention nft for example um so I'm just gonna I wrote a truffle script for this so I'm just going to execute it

um and it should have minted and if I go back to was it this one uh I hope it was this one is that where's the log ding where did it go is this the wrong one you know it's fine I will just show you the screenshot because I came prepared um I think I came prepared Okay cool so basically doing the same thing um

and I guess here I oh oh that's why sorry I minted it but I didn't list it and I put the console log in the list function sorry that's why it's messed up um so just to I guess re-clarify if we did it again so I minted the uh nft and then um let me get the contract address um cool I'm just going to populate it here and now if I do this where's my ganache right here yes everybody clap I did a

good job thank you okay cool um next piece I wanted to talk about was uh now that we've deployed it let's actually do the debugger uh so to debug that let's actually debug this transaction right here um to do that all you need to do is a debug and then you can just throw that in there um and this will take a little bit of time to work I don't know why it's so slow but yeah Okay cool so basically you can just step over I'm in the nft uh list

nft thing um you can set a break point so let's just go ahead and do that I don't want to step through all this um oh that's not my code let's talk about let's get to here so line 83 um so B Marketplace that's all 83. I can just continue and I should get to there which is cool and obviously you can see all the variables um and the storage variables if you had interacted with it during the duration of this transaction um and like the message sender and stuff like that so that's the Truffle debugger locally

um I'm going to tests go into uh the testing version so with the debugger you can only debug transactions right now if you want to debug like a solidity call you would have to do that through the test so let's bring up our test Marketplace um list nft or I think it's like get all listings yeah let's do this one so you would just throw in a debug statement here um and then a truffle test I think that's all I need to do oh debug um in this specific case I didn't bring up a separate ganache instance this is just managing it on its own so it's going to bring it up and down but yeah see as you can see it interrupted it again specifically at this call

um and I'm just gonna assume it works uh so the last piece I think I wanted to touch on was the mainnet so it has been pulled up uh this is I guess Infinity exchange I don't know what that is uh but if you can see here actually this is really cool so this is I guess a hard hat console log if you go into it um dang I skipped it no let me try again okay uh next next next next where is the console log oh dang I skipped it again sad okay basically I'm not gonna keep doing this uh because I'm speeding through but if I had not missed this

um you could actually step into console log it would have referenced the hard hat uh contract and then you could step through that as well again doing variable analysis and other fun things with the debugger uh so that is the debugger what's next debugging with Frederick sternel that's what I just went over CLI debugger in test debugging this okay vs code debugger so this is a live one um I for some reasons got this to break yesterday and I don't know how to fix it so I'm just going to show you a video of myself domoing it a while back um so yeah I'm gonna play this out like this ganache instance

um oh it did oops um debug this transaction as you can see we have all this information here um for this particular transaction you hit run and debug and I believe I think I was debugging nfu with royalty so set a breakpoint here hit play um as you can see now I always open ID was two token URI URI relative receiver all that information is there and this is really helpful because I had messed up why it's not working debugged I was like oh that's right because I put in the wrong number cool I don't know if you understood any of that but it doesn't matter because it looks really cool um kind of what's coming up next uh as I said before

um so right now the CLI debugger only works with hard hat right now we don't have support for Foundry if you are using it um if you are using it we are open source please contact me we will help you build it together again the vs code debugger has some limitations like I said it doesn't have hard hat support yet we are working on that vs code debugger is not going to work for truffle manage test so when I talk to that specifically it's like if you run a truffle test and you decide not to bring up a separate ganache instance to run it vs code has a little bit of difficulty understanding that you would have to use the CLI bug fix obviously I had to show you a video of myself because there's a bug um debugging reverted calls and tests is kind of funky so improving that in

transaction function execution uh so I mean what that means is basically while you're debugging you can probably just call like make another solidity hall within the transaction figuring out how that works and then again console log into manage ganache instance so I I showed you console log in like a separate ganache instance but if it's going to be in a test where they bring it up and tear it down that's not merged yet but you can imagine it'll look something like this when you run your test cool last piece OMG am I going to get hacked so obviously smart contract security is something we really care about first off I think for beginners the easiest way to get hacked is exposing your private key so how do we avoid that right so there's this Nifty thing called truffle dashboard that I

had mentioned before so I'm just going to deploy the contracts again and you can just bring those through like a truffle dashboard it comes up on localhost 24012 so if you are using hard hat Foundry you just specify that localhost you can hit confirm and basically you can choose whatever Network you want to deploy on and I'm just going to hit confirm and I don't want to spend money so I'm not going to do this um but you can imagine this is how we're going to deploy you can Min transactions um or sorry not man just like run transactions in general um and that way you never actually have to write down your private key which is really nice it's really great for my demos as well because you guys won't know my secrets um this is coming soon so this is kind

of where I mentioned transaction insights are like the decoder coming in again like incorporating into your workflow that you know what is going on exactly in your contract and it comes in dark mode so yes okay cool um and then one more piece left um now once we get a little bit deeper into the security Rabbit Hole there are uh attacks of all types what exactly is truffle doing about that well specifically if you guys don't know this uh truffle is part of the consensus family which includes diligence a smart contract auditing tool so what that means is we are ripe for collab what does that look like so just to briefly

touch on what diligence does they have a whole Suite of tools I'm specifically just going to kind of go over scribble and then mythex mithril so scribble is going to just be an annotation language on your smart contracts that are going to instrument it to be used in various fuzz testing tools whether that be like diligence owned I guess like fuzzing as a surface I think it should not I don't know how to pronounce that but that's like another fuzz tester scribble allows you to process your contracts and then throw it through those things mithril mythics are going to be just vulnerability analysis things basically diligence is doing a lot of cool things um we work at the same company how do we work together I actually don't have that much detail about it because we just decided this very recently

um there's right now we're focusing on truffle boxes so if you guys don't know truffle boxes are boilerplate scaffold code for different types of project Integrations as well as tutorials so this one guy right here is we're coming up with like a list of like various smart contract vulnerabilities and then an example of its mitigation so that's just more so like a beginner focused educational aspect um and the last piece is like just tighter integration with diligence tools we have our vs code extension scribble comes as a vs code extension truffle also does have a plug-in framework how do we mix that together I don't have details if you guys want to make suggestions uh obviously with Discord uh GitHub Etc but we are really trying to

be a security focused development environment because that's kind of the next iteration of smart contract development past just like your build adap in 10 like minutes or something like that right okay so the last piece is thank you I hope I didn't go over time I did go over time uh that's fine I'm Emily follow me on Twitter uh truffles Twitter is here this QR code scans to like a list of links of which one of them is the links to the slide if you have any questions I guess I can take them now thank you so much and for daring to do live demos on stage oh I love live demos so if I make a mistake I like become more what you call it real they're like oh exactly yeah it's not too preheated

yeah um does anyone have questions for Emily okay that means my demo was really like exactly eight plus thank you so much yeah