CommSec D2 - Smart Contract (In)Security
summary
Shows concrete exploits and countermeasures: the Parity library delegatecall + uninitialized library bug that locks $160–300M by letting an attacker become owner and suicide the library; the DAO reentrancy that drains ~50M ETH via an unchecked withdraw order; why using fallback function vs send/transfer (limited to 2300 gas) matters; constructor-name and visibility mistakes that turn initializers into public drains; RNG via blockhash and overflow/race pitfalls. Mentions analysis tools Mythril, Porosity, Trail of Bits and Binary Ninja and PolySwarm.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 2:45Parity wallet library bug
- 10:01Reentrancy vulnerabilities
- 15:25Second parity multi-sig hack
- 17:51Constructor and visibility flaws
- 20:45Public execution risks
- 23:15Security tools overview
related talks
51mA Deal with the Devil: Breaking Smart Contracts
43mOutsmarting Smart Contracts
12mSmart Contract Security
20mLearning How to Build Secure Smart Contracts
49mHacked Blockchain Projects What we’ve learned
20mSolidity's most common security pitfalls and its best safeguards
18mFavorite DeFi Vulnerabilities
26mAll your Ether belong to us (Hacking Ethereum-based DApps)