Honeypots: Hacker Traps on the Blockchain

Transcript

events hacker traps on the blockchain take it away so these work yeah oh boy I have a timer I didn't expect that uh so hi everyone I'm Noah from hacken and today I'm going to be telling you about a really obscure exploit uh type called honeypots which are pretty much hacker traps on the blockchain so to skip about 25 slides let's go to exploiting smart contracts um you want to exploit the smart contract and here is you and you find a Target and you think you got an exploit and there's two things that could happen one front running Bots somebody sees it on the mempool because

you didn't use flashpot protector something and ah you missed your chance buddy option two you are a bad hacker you did not correctly identify your Target and you were trapped by something called a Honeypot so what are honeypots uh well smart contract honeypots are a special class of smart contracts that look vulnerable but aren't the big idea is to make you as a hacker or a security professional in pigment you can earn some money by sending funds to that contract when in reality there is some quirk in the engine an eater scan or in the code that means that only the owner slash the deployer can uh actually withdraw These funds uh so some

quick technical examples here's the multiplicator Honeypot that's like the school level example and in this case we have a simple function that takes uh that's payable and it takes checks if your message value is bigger than the balance on the contract and if it is uh it sends you all the funds on the contract now uh anyone here know what's wrong I mean it's written but come on uh so this is the balance already include your value so this if check is really just going to be deleted by the compiler and nothing happens this is an empty receive block and it's beautiful

and this doesn't really work in practice right it's too simple but here's one that actually does um so this is this uh gift box sorry this is a king of the hill game and in it you have a stake function it checks if you sent more than the largest stake and if you did uh then you become the new owner the new king of the hill and then using the withdrawal function in the right you can withdraw your funds right uh and this is all fair except those uh eagle-eyed among you may have noticed there's two owner variables one on the left one to the right uh the one on the

left is set in the Constructor on the left and defines the modifier on the left and that one is never changed again uh well one on the right does absolutely nothing and is the one that's modified so the original owner of the contract is gonna stay the owner till the end of time and they can call the withdrawal function and take all your funds sounds silly does it well would you like some money because uh these people did and look what happened to them it actually works and it's somewhat profitable again this obscure this is not 200 million Euler hack this is like 1 million over the last five years micro hack

um but this guy earned a few thousand Euros and nobody can tell him uh whether it was legal for him to do so or not actually it's sort of illegal based on the most recent legal advice I got just in case you want to run your own but yeah um the next example uh just keep it quick gift box so everybody here knows how to uh how to do passwords properly right you want to use chat uh you want to use chatri and not just set a password because everything is public on the blockchain and the gettygift function it's okay don't worry about it the tricky thing is the set pass function which is also in general good ish it checks if the password has been

set and allows you to put some money on the contract to set the password so pretty much set the get box but you come across this and you look on eaterscan and uh there's already some money on the contract right and it looks like uh somebody said the money because he want more of a reward but forgot to set the password and then call the set pass function and by default that's going to be a hash of xero and I think that's something that you can get to uh or you just you know call the set pass function uh and sorry because uh sorry you cannot get to that hash but you just call the set pass function with one eater and you

get all the money out right uh but the thing is there's a problem with eaterscan for the last Infinity years and that is that it's not very transparent about contract to contract transactions uh and this is actually a good place for me to mention this because now you can all go to eater scan and tell them please fix this um you see something called this set hidden function from a contract and if you look at the inter scan nothing here if you go to internal transactions and turn on advanced mode and read into every single transaction eventually we figure out that the state changed here which is a bit of work right so yeah that's a fun one um

so yeah these are the Honeypot examples why do they work one hacking is a nasty business you got about one minute to find your hack before somebody else does right when the contract is deployed uh two there there is a ton of hackers that don't really know what they're doing they're just running a tool like to is a big example if you know it but in that case somebody may be exploiting that tool and three just eaters can sucks um how do we detect them so symbolic solvers uh heuristics as was mentioned yesterday you need to be an expert you need to know what you're doing and what you're searching for and then you can like create a solver that's going to

check for specific scenarios option two uh transaction patterns so that's something the incident detection crew is going to be really good at and uh be able to maybe find them that way that only works for ones that have been exploited though uh because I know ml training on bytecode is sort of tough um so Standard Process get all the contracts get all the data generate your training data using the symbolic tool and classify using ml right and what can we get out of that well there's in that period that was tested about 2 million smart contracts there's a lot more now and of that only

150k were unique I checked about two weeks ago and right now there's only about 600 000 unique smart contracts so it's uh it's still not that much honestly of these 50k cash flow and about 300 honeypots not very common um which is two and a half thousand deployed ones when you account for duplicates um what are the types so balance that's the silly one somebody fell for that I know and then we have a few like code issues uh and then we have a few eater scan issues and as you can see The Ether scan issues are the big money maker uh so uh there's some additional cool ones that have been discovered recently role

encoding uh okay you know the Greek question mark you know replace the semicolon in someone's code what a Greek question I can just watch them off themselves yeah you can do that in solidity as well so you take open Zeppelin's Access Control library and you pick like a random language like German and you find the normal you know o with umload and you find another similar looking Unicode character and you just mix those around as permissions in code and somebody's gonna fall for that so yeah nice one another one is just you know do not put the parentheses on the call and watch what happens it gets removed by the compiler and uh you can make the code look a lot different uh for somebody reading it right uh

insights uh again sorry this is really fast uh they work usually only once you would expect after some defaults for it you get uh at least some info from eater scan about uh it being maybe dangerous um they follow price Peaks only when they're the most profitable uh so I really wonder how many there are right now uh probably a few more of these patterns and uh they're not very big only 250 each so 1 million in that time period maybe like five six million till now not too bad and uh right now uh yeah

you can detect them pretty well for the known types using uh the symbolic solving approaches if you're interested in finding out more uh continued research on the honeypots projects is within the Smart Box project which you can find the GitHub repo for here it's a pretty useful General like tool aggregator so uh yeah check it out and I hope this was a fun topic for you guys because that's all it is foreign