D1T2 - Smashing Ethereum Smart Contracts for Fun and ACTUAL Profit
summary
Shows concrete exploits against real Ethereum contracts and explains why Mythril (the “nmap of Ethereum”) plus symbolic execution find bugs that static linting misses. Demonstrates autogenerated exploits using the Z3 solver to trigger delegatecall/library storage issues, call-proxy and external-call/state-change races, and reentrancy patterns that have frozen or stolen hundreds of millions in Ether. Presents measurements from live blockchain analysis, example exploit transactions that execute, and a working toolchain for finding and weaponizing these flaws.
AI-written summary · about
chapters (25)
- 0:00Introduction to smart contract exploits
- 1:42Security analysis tools overview
- 3:41EVM execution and gas costs
- 6:00Global state and transaction execution
- 8:01Function signatures and crashes
- 10:15Symbolic execution basics
- 12:47Industry use cases and examples
- 15:31Dynamic bonus codes exploitation
- 18:03Storage slot manipulation
- 20:30Large number overflows
- 21:59Index and mapping vulnerabilities
- 23:30Remix IDE and contract analysis
- 25:01Challenge and suicide instructions
- 27:33Transaction history and exploits
- 28:41Modifier and function conflicts
- 30:50Library contract exploits
- 32:19Functional security and proxies
- 34:18Parity wallet exploit
- 35:51Call stack and fallback functions
- 37:15External callcenter risks
- 38:42Contract creation pitfalls
- 40:18Storage location constraints
- 41:10Mystery canalys deployment
- 42:57Contract trust and reliability
- 44:00Summary and key takeaways
related talks
51mA Deal with the Devil: Breaking Smart Contracts
26mAll your Ether belong to us (Hacking Ethereum-based DApps)
10mHow to Understand a Smart Contract Hack
43mOutsmarting Smart Contracts
23mThanks for all the bugs!
24mteEther: Gnawing at Ethereum to Automatically Exploit Smart Contracts
13mAdvances in Automated Smart Contract Vulnerability
46mAll your Ether are belong to us (a.k.a Hacking Ethereum-based DApps)