Insecurity Through Obscurity: Veiled Vulnerabilities in Closed-Source Contracts

Transcript

Huh? Oh yeah. Uh hello everyone. I'm Seang a PhD at Yo University advised by professor Fenjang. So my research interest include the defy security consensus security and many design for decentralized ecosystem. And today I'm very happy to share about recent study in defy security. So this is joint work with Taiwa a and fan. Yeah. So I believe everyone here is very familiar with the uh blockchain. So for blockchain we have layer one like Ethereum, Binance, Solana. We also have layer two like Uptron and the base and

we have many protos on top of it like landing protos, decentralized change and ors. Yeah. So with this uh protos we have a eosystem where users they can perform uh activities on top it. So this device system and users can have their device activity on this blockchains and uh this create a new class of perfect seating behavior called MVV where the transaction ordering matters. Yeah. And uh new player come in. So they sit the

prefable transaction opportunity from the main pool or from the broadcast state and try to capture the opportunity through their own chain smartphone chat. So those player are known as MV searchers. Yeah. So their tone chat are known as MV bots. Yeah. Okay, so we know that the top MV boss they are very profitable. They earn a lot from the onchain activities. So we can see the total app charge revenue in a week is more than 2 millions and

this uh inbox they are total source. We uh literally know nothing about their business logic. Even though we can maybe do some reverse engineering but still a lot hide them behind the tone chart logic and maybe we have one question that yeah even this contract they are so portable they host lots of assets on their contract were they attacked by adversaries before. So if we search some attack against MV boss on Twitter, yes definitely we have from 2021 to 204. So we can find at least three attack

against MV boss and there's nothing new on the sun. So every boss they will probably bounce on adversaries and their asset was transferred to another address. But uh are those uh tasks for complete this set? Uh or no. So otherwise my talk is over and I have nothing to say. So today I will talk about new attack vectors which we called MV fish against MV boss and then I will analyze what's the security issues and what's the challenge behind

the security issues and the last I will propose our solutions standf yeah so first let me explain the idea of MV we finish a task. So I think the key idea is or the key issues is not very hard to understand. So this is essential mechanism. So we know that the tempation on blockchain is very expensive. So which means if you want to do a reader permission chat is also very expensive on blockchain. Uh look at this example.

So this is a reader chart against whether uh transaction to is from a unis swap v3 pool it will cost about 450 deaths. But if we do something else we already chat whether the transaction orange is from a site address is only consume about eight deaths. So as a perfect driving contract all of the players they may consider maybe I can save my desk and maybe use the trans.org one so should I use that or will it cause some potential issues?

Yes. [snorts] So when we try to use orange asententral pattern everyone will try to bypass this asententral patterns. So the idea is of MV fish tag is that how can we be part of the MV supply chain. Yeah. So when a searcher try to extract NV from their tone chat so the NV sub will include many other tone charts like Yas20 to chart tone chart or the swap pool chart. So this P chart is involved in the same transessions which means if this tone chart are malicious

they already bypass the the asset control mechanism. So the next I question is that how can we be part of the AV supply chain. Yeah. So here I want to first share some data with you. We uh analyze the transaction on Ethereum from July 21 to April 2025. So we identified at least 104 attacks against boss. Yeah. So the total loss is 2.76 millions in total and the one single largest stat that cost around 600,000

dollar in total and our further analy show that this attack even include three varants. Yeah. So then I will uh show different uh MV fish strategies and first uh so we will analyze the attack strategy but most important don't practice attack strategy in practice and not guarantee you will win or loss or any little issues. Yeah. So the first I think is totem base and efficient attack. This is the I believe a most traditional one since 2021.

So the idea is very easy. The left side is a tatter's workflow. So as a tatter I first deploy a malicious totem which have a bad door within the token and then I create a pool for the malicious totem. So it can be any uh standard pool like unis swap v2 or v3. And then the most important step I create NV opportunity. So for example uh swap that sly change the pool price. So the MV searcher they will identify this MV opportunity and they believe so here is opportunity for up charge. So I can do

that the searchers they start try to extract MV they will involve them B the M bot will try to interact with the ES20 token. So when the ES20 token is involved then the bad is triggered. So at that same time the transaction oh sorry the uh asset central mechanism is already bypassed. So the uh yeah Malaysia token they can explore the vulnerability within the MV chart. For example the arch within the MV bot chart as this tone chad may need to uh allow to any swap to finish their defectivity. Yeah.

Then the next one. So the searcher now they are smart. they will check whether the Yas 20 token is standard or not. So in this attack now the attacker they doesn't deploy a malicious token instead they use a malicious pool. So in this case they can use any other uh standard Yas 20 tokens but they trade their own pools and similarly trade opportunities for the searchers and searchers they are very happy they only chat whether toten is good or not and they start up charge then the battle within the pool is

triggered. Yeah. Similarly, the MV bot will be spotted if there is a vulnerability. Yeah. And the last one I think is most interesting and uh in this case the attackers they used standard Yas 20 totens and even standard pools but they found another possible malicious address that based on the new MV refund systems. So the MV refund system that brought from me will request that the searcher if they extract MV from their system they need to refund a sufficient address

within the same transaction. So the searchers they may chat whether the pool or the toten are little or standard but they may forget that the refund address could be a malicious tone chat address. So they just do the upcharge and uh and the last step they refund the uh some ease to the refund address then the bad doll within the refund address is triggered and finally it's part and we bought on chat. Yeah.

[snorts] So now we know the fact that any boss they keep suffering losses. The question is that why do they not use tool to secure their tone charts or in other words so if they use what are the challenge to prevent this tool from being useful? Yeah. So we have summarize summarized several challenges here. So first the challenge is tential flow ofation. So we know that the uh 700 developers or this MV searchers they may try to involve tial flow opsation to protect this their business logit so it's very

be harder to be reverse engineered and or they may just try to optimize their death usage and the byproduct of that optimization will also be the control flow optimization. Yeah the most important thing is that when the tflow opation is introduced, the most of standard tools they can not work. For example, if you use some stats tools, they will send the most of code within contract is not reachable. So they will tw those who were told and say this tone chart is not one bow and yeah then the hiden vulnerabilities will be triggered

by other advanc attackers. Second even if the tone chart doesn't involve any uh control flification the tone chart itself may still be very complex and this and we bought ton chart they may integrate many features like fresh loans trading on different uh deaths and some other features. So an analyze tools they may turn out when we try to explore the many different state and third so when we try to write smartphone chat we may hardose some data in our tone chat and the set analyst tool or other tools they

may not very accurate when they enter the case that if a parameter is partially trollable. Yeah. So they may just see this uh parameter they are safe as they are harded and the adversary cannot control. Yeah. Uh therefore to solve these challenges we propose our solutions based on our observations. Yeah. The first idea is how to deoffestate the trool flow ofation.

So this is based on our observation. This is very interesting design. EVN specified that every little jump stationation within the bode should be marked with the bode jump. And with this feature so we can mely let all the jump destinations and try to rewrite the instruction to made the tflow is so we do. So the left side is original to we can see the jump here it relies on a runtime value from to data. So which means they cannot be decide during the set analyst. But if we rewrite the tone

chat and we insert some table here and we can rewrite the indirect jump to a direct jump and every every jump destination now is a stat value on the stat which can make stats or other NS feasible. Yeah. The second idea. So we know that the templacity smartphone chart they may include uh many execution paths. So if we do the blind pass exploration it will be very slow for such compressed smartphone chat. This is a well-known issue about the state issue. Yeah.

However, sorry, we also observe that for smart home chat, we know their real world execution trace. Yeah, the transaction is public available on the smart on the blockchain. So why we just prioritized exploration based on this real world trace? Yeah. So within the historical transaction available from the Sah uh blockchain, we can analyze which assertion pass is most frequent and we can try to prioritize our exploration to this path and see if there's a hiden vulnerability within the assertion path.

So we can guide our symbolic attution based on the historical transaction and try to find if there's a vulnerability within the most frequent attion pass. Yeah. So the final idea is to identify all controllable or risky parameters. So here we plus uh 10 analysis with uh 10 analysis to identify the all parameters that are controllable and we also have a collection of the risky parameters. So if a parameter is not controllable but still risky such as the function slatter of transfer which means the adversary

they can control the parameters and made any transfer to another jazz is still very dangerous for the uh tone chat itself. Yeah. So putting this idea together we have stf the input is smartphone chat and if the smartphone chat is a faceted we are first dealitate it and then we'll do a histoal transaction driven symbol execution plus 10 analysis and we will identify the potential vulnerabilities and first finally we'll try to automatically generous exploit against it.

Yeah. So here I will tweet those through the uh our evion results. Yeah. So first is about the deoffestation result. So we apply the stand to the state of art and stats to data horse and see the total before and afteration. And we can see after deoxitation the total coverage is very close to 100 which means that the staff can effectively retire the tension flow logic and enhancing the efficacy of the existing stat analyst tool.

Yeah. and sedent for vulnerability detection. We compare ST app with other state of art symbing tool and we used 6.5,000 MBOS with L from different websites and as a data set we found that our tool identify the most vulnerabilities and success generate around 400 of them. Yeah, we even quantify the potential loss. So if this smart home chart were exported, what would the maximum potential loss will be? And the maximum potential loss will be higher than $10 million.

Yeah. So [snorts] finally we check the runtime of each tools and we can find within the time samp budget f can find more vulnerability to others thanks to the real world transaction driving support execution. Yeah to summarize in today's talk I talked about three new attack vectors against MV boss we summarize at MV fusion attack and we analyze the challenges of analyzing such tone chart include the offensation complexity and why simple pattern match doesn't help and we also propose our solutions about deoffestation historaction uh uh similar attitution plus tent

analysis And this evaluation shows its efficacy in deautheation and vulnerability detection. Yeah. So we also have a paper onab and a small blog post to explain it. And this is my website and feel free to ask me if you have any questions. Okay. [applause] Thank