The Gas Siphon Attack: How it Happened and How to Protect Yourself by Shane Fontaine (Devcon5)

Transcript

[Applause] this is presentations at all I guess I don't attack how it happened to how to make themself it's an overview of gas exploit changes that happen last year it relies on a concept called Gaston canvas this concept is too hard to get into in five minutes but what it basically is is the ability to refund yourself on the etherium devil if it's built into aetherium and it's effectively in your seat 20 that pays for your gas so give it that context you'll be able to

understand the rest of the song and then so they attacked given that token is the next point whereby anyone who pays for a transaction fee can be to be attacked by minting gas token for you so in this example exchanges who paid for your withdrawal fees which is all the changes in this case if you withdraw if you make a withdrawal from an exchange into a contract that you created that has this exploit iment what ends up happening is the exchange mints gas token for you so what that means is they pay a very high gas limit in the transaction for your withdraw of a very small amount of heat

and what that does is it prints you of gas token that that allows you to drop it from their pain for the withdrawal fee so in some extreme cases exchanges pay up to $50 for you to withdrawal from their account and effectively you're making $50 so that was the premise of what happened last year and when it happened if every exchange was affected to varying degrees of severity and in Who am I co-founder of the gas second attack if you audit with zero trust and we have a wallet company called off period one question that I always get with this asked is gasps token good the basic idea is good it says if you want to clear

some estate on the etherium network will give you a refund for doing so to make the state smaller but what's happened in reality is a lot of people are using it maliciously so people are printing a smoking now with the intention of using it later and if that's not how it was intended to be used but it is how it is being is now I mean how are people using s a lot of people are using it for arbitrage so when they go to make a trade or an arbitrage whereas anyone in this room will be able to make $1 someone using gas soap you might be able to make a dollar and ten cents because they're there and their fees are reduced because they have Denisovans exchanges can use this has effectively unguessed futures but that's a little longer conversation accent here's one example

transaction you can look at later in the only really important part is this isn't a control for an exchange and you can see here the transaction fee is point two either so this is basically saying that an exchange they point to ether in order for me and which are all point O one evening for my exchange account so that 34 dollars at the time came from living change and so it's a very real attack how can you change this fix this the answer is don't pay for a user's gas more practical answer is a charge of withdrawal feet that's greater than would be of the fee that the user can Minden yes okay so so someone like point base charges $5 order withdrawal fee the user who wants to

withdrawal print Gaston games can only be able to print lesson and it wouldn't make economic sense a few examples of interfaces that don't turn an abstract with gas but if someone painters our trust wallet what makes it mathematic you'll see here they don't even mention gas but if you use one of these wallets to send money to someone or said when you do a contract what might happen is that contract might be trying to save gas from you you almost won't even be able to recognize that you're being attacked so it is pretty dangerous there's just something I walked out for and then I'm running out of time here but but real could be some interesting facts these guys and so so some interesting

facts about gas as everyone knows the gas prices currently rising those two graphs show it what's seen here it's that miners are actually now using gas token that blocks some of the blocks they mind their only minting Gaston so if you look here they're not collecting any fees all these transactions are straight from the straight there are miners transactions they're not paying any fees and they're just using the whole block a mind to print gas token and it's pretty crazy that's not how it was meant to be used but but we're seeing it happen in the real world here's the use of gas token rising over time the same things happening on these classic nothing's any better and finally that there are markets for gas token so people are starting to

trade gas token as in the air see 20 token and not as the gas refund it was meant to be so the point of this talk was to kind of show you what gas token wasn't to make you aware of it and how to protect yourself so if you're vulnerable thank you [Applause] you