Outsmarting Smart Contracts
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 10:15· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Shows concrete failures: default-visibility functions let anyone seize wallets, default-public functions; arithmetic errors let balances wrap to zero, integer overflow; gas-model quirks let attackers freeze auctions, and a short-address bug lets withdrawals multiply tokens. Demonstrations use Etherscan, MetaMask and an on-chain encrypted-notice prototype called the responsible-disclosure messenger that posts a ciphertext and later decrypts locally. Cites real losses (Parity ~$30M now $130M, ~ $150M locked) and gives tools and test practices that successfully find and prevent these bugs.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:34Blockchain is everywhere
- 1:35What is blockchain
- 3:39What are smart contracts
- 4:36Why use smart contracts
- 7:37Executing smart contracts
- 9:25Security of smart contracts
- 12:09Pareto wallet
- 13:28Blind commitments
- 16:58Libraries
- 19:34Gas Limit
- 20:57US Attack
- 23:45Lessons Learned
- 24:39Attacking Web Applications
- 26:27Too Short Address
- 29:09Attack
- 31:02Vulnerability
- 33:14Demo
- 36:03Summary
- 38:02Questions
- 38:42Crypto Exchanges
related talks
25mCommSec D2 - Smart Contract (In)Security
51mA Deal with the Devil: Breaking Smart Contracts
26mAll your Ether belong to us (Hacking Ethereum-based DApps)
46mAll your Ether are belong to us (a.k.a Hacking Ethereum-based DApps)
20mSolidity's most common security pitfalls and its best safeguards
49mHacked Blockchain Projects What we’ve learned
18mFavorite DeFi Vulnerabilities
20mLearning How to Build Secure Smart Contracts