Scale Your DeFi Research with Static Analysis

Transcript

Uh my name is Jason and I am a glider security researcher at Hexans. Today we're going to talk about scaling with static code analysis tools. So in security research uh we focus on three different modalities. Uh one is bug bounty programs, two is private uh audits and the third is audit contests. In each of these categories, researchers are going to review a limited scope of smart contracts to identify as many vulnerabilities as they can.

In this research, uh it's it's quite excellent for identifying vulnerabilities on a project level. However, it is ineffective and I would argue not scalable when we want to identify vulnerabilities on a blockchain level. So we have a problem which is how do we identify vulnerabilities that just not exist in a project but also elsewhere on chain. I believe that static code analysis can help us bridge this gap. Um I would argue that this is a fourth modality of instead of thinking about audit research on a project base we think about it on a chain base.

So what is static code analysis? Uh to sum up it is the process of querying source code in our case smart contracts to look for code patterns in our case vulnerabilities. And the way we do this is we write a query uh typically depending on the tool that you use uh that could be Rust or Python. And this query identifies code patterns. It's programmatic, so we don't have to do any manual work besides writing the query. And it's also scalable because we could run this query as many times as we want for however long we want. Um there's currently in the ecosystem a list of available tools. Uh there's aderan,

there's slither and the one I work on a daily basis, Glider. And this talk will be covering uh focused on glider. So with static code analysis tools, we have available to us a library library functions that we could use to query for all sorts of things. We could look for functions defined in a contract. We could look for if a contract has been inherited by another contract. We could look for state variables. We could check for global variables. We could look for local variables. We could see where these variables flow to which is called data flow analysis. uh is extremely helpful for many vulnerabilities and in particular with Glider we could

actually run a query against the entire chain of every verified contract and we have that in our database and you can run that as many times as you like updating the query whenever you want for new contracts that are deployed on a at any time. So uh what I want to show next is a demo of a glider query that looks for a very famous and old vulnerability called unis swap v2 spot price manipulation using the get amounts out uh function. This function obviously returns a price that is then used in a swap. And so normally in traditional

research uh we would have to go line by line and review and look for this function. Then we'd have to trace where this return value of get amount out flows to. Uh this requires significant effort, time and energy on our part. We have to find the contracts that support this that call this that have this sort of code pattern. But with uh glider we will be able to look for this automatically. So, uh, in this video, we're going to show, uh, this is the glider IDE. And right up here, we have our glider query, which is going to look for instructions. You could think of instructions as a line of code that

looks for a a instruction that calls get amounts out. And then we're going to do something called, as I mentioned before, data flow analysis, where we're going to trace where that value, that return value from get amounts out flows to. And we're going to check to see if it goes into this swap function. I'm going to go ahead and play uh the video and we're going to run it against the glider IDE and it's going to scan. Um, in this case, I have limited the results to a single infected uh vulnerable contract that was found two weeks ago. uh you know as old as this is uh this um this bug still exists. So uh here we could see that uh the contract

was found and that get amounts outflows to the swap function. Um here's all the links. We also have a glider contest ongoing for static code analysis query. Submit your query and get paid. It's sponsored by Ethereum Foundation. And if you guys want let me talk uh ask questions um I'll be here. Thanks guys. >> Awesome. Thank you Jason.