How to Understand a Smart Contract Hack

Transcript

cool so actually next we will have a special speaker Daniel VF is going to talk to us about how to investigate what happened um when you've been hacked yeah actually slight change when somebody else has been hacked uh and why is that valuable uh well there's no better teacher than the enemy to start out with and you learn real exploits and there's a whole giant pile of exploits you could write like 100 security vulnerabilities out and Auditors are really good at catching 50 or 60 or 70 or 80 of these um and you know can find them all the time automated tools can find them but what you really care about are the ones

that are likely to get past all the layers of Defense all the layers of checking things that you have and that's the ones that actually get exploited and so you're automatically following the latest advances in attacking contracts you know you're only going to be one contract behind or you know the first time it happens if you're following them then you get to see what it is um and you know the odds are that the first time an exploit's deployed it's not going to be you it's probably going to be some other protocol so you know you can add like a 90 another layer of cheese another thing that blocks 90 of attacks if when somebody else is attacked you study how it happened and then you immediately turn around and check your own code for the same problem

um and so that's what I've been doing for almost two years now is anytime somebody gets hacked in the D5 world if it's more than a million dollars and it's on ethereum mainnet I go in and try to understand it you know as in right away figure it out and then check our own code um and that's tremendously valuable and as I've been doing it I've been getting faster and faster and so I just want to share kind of how you can do that uh for your stuff now attackers have lots of superpowers when they're attacking contracts uh you think of a heist movie or something and all the work that goes into before the heist uh and a lot of that attackers get for free they get to have a perfect copy of your environment they get to see everything that's there

without having to walk around your bank and scope it out they get to see where all the defenses are they get to practice against a perfect replica and once they've practiced and found the perfect way in they get to execute exactly that and 95 99 of the time it goes perfectly for them but you as somebody as a detective also have super powers in that you can follow the exact trace of everything that happened down to every op code that executed every memory location that was accessed every storage slot that was changed um so here's how you use it in an attack there's the attack contract uh there's a victim contract there's a flow of funds that happen during that attack and then

there's the execution Trace now if you actually look at an execution trace or you actually look at the flow of funds you'll see that it's usually way more complicated that than that there'll be amms involved there'll be third-party D5 protocols involved there'll be flash loans um just a huge surrounding cloud of things but in reality it all comes down to pretty much you know you want to focus in on the attack contract the victim contract the flow of funds and the execution Trace now where should you start in that the execution Trace is hands down the best place to start it lets you see the big picture the four tools I kind of recommend off the top of my head would be ethtx.info which is my favorite usually

ddob has a good execution Tool uh block SEC team I think has a good tool and I'm blanking on the fourth but uh they're more out there oh if you really have to you can also run a fork against uh the contract like the block before re-execute the attacker's thing and figure it out all on your own computer but anyway so as I said there's this huge mass of things that are actually in a hack of in the execution trace or in the funds flow but you can kind of simplify it down into the usually an attacker does something to get the funds that he's using some kind of flash loans or something then there's the uh kind of the setup usually they need to

or you know or get get things in place there's a moment when something goes wrong and that's often like step two is to somehow throw the victim contract into a bad State and then step three is exploit that bad State and then step four is this whole unwind process get back your funds and everything else of the code that's actually run that first part and that last part you can often just skip when you're analyzing the attack to actually find what the vulnerability is and so that cuts down tremendously what code you need to look at um so what you're really looking for is that first bit of weirdness the first

time things go wrong and so if you're looking through the execution Trace you know all set you know first we're talking about thousands of dollars and all of a sudden you switch to millions of dollars you know you want to find the very beginning of weird um and then once you've found that weird then you kind of go to the victim contract and look and find out how that happened and why that happened uh that's kind of the normal typical flow and after you've been doing it a while you know very common patterns start showing up and you can just see from the uh the contract or the execution flow that hey this is a re-entrancy thing um so that's kind of the normal way of do you do it now if you want to go to the next level the really weird level uh

sometimes hacks get stopped before they ever happen uh an attacker deploys an attack contract uh people see it and it gets stopped before it ever happens now in that kind of situation you don't have any execution flow you don't have any funds flow and until you figure out what the attack contract does you don't even have a victim contract really so that's really playing on hard mode but that's uh you need to do compiler and you need to follow it and that's a whole nother conversation for another day but anyway that's the quick thing I think it's incredibly valuable to study hacks and it's it's possibly the very best education you could have reports on Hacks are sometimes wrong sometimes to a surprising degree it

really counts to look at it for yourself one last Advantage you get is you get a real sense of bad code smells because you're reading through your own code and all said you know oh this is like that hack I just saw and then you can get not do it thank you I'm Daniel Von fans thank you we have a couple minutes if you want to take questions yeah so I have a question um what tools do you use for forking the chain if you want to look at it um locally on your own computer so I am a huge fan of eth Browning the amount you have to write uh compared to using something like hard

hat uh you just get to you get to use giant numbers without any kind of extra anything it automatically uses the address of things when you want it um so I use eth brownie for almost everything I do for fork based testing or live interaction with contracts um also including testing our own contracts in a forked environment as well I use other tools for building stuff but for uh live interactions with contract it's Heath brownie all the way every day any other questions yeah go for it thank you

hi I'm pincho thank you for the talk nice my question would be first I should say I super Echo the fact that many reports of millennialities are wrong so it's crazy um and once you start like following them you're actually understand that the team probably wasn't even understanding what was going on so my question would be why is that happening from your experience why do you think once we start actually going into details of the postmortems we are security independent security researchers realized that they are actually interested in the facts and as they should be well I think that the reports are

actually mostly right you know it's it's just occasionally they're wrong um and so it's not a huge problem it's just something that does happen and you know be surprised by it you know a lot of times it's because um somebody takes a first look at it makes a tweet about it and people who haven't verified it you know retweet it because it sounds plausible um and so it just spreads from there you know sometimes there's a a wide variety of competence in teams and some teams don't get it and uh never get it but uh all right thanks very much Daniel [Applause]