sub0 Asia 2024 - Ariel Waissbein (CoinFabrik)
summary
Tooling claims to cut common Ink! bugs before audits by scanning compiler intermediate representations and flagging low‑hanging fruit; it uses the Rust compiler IRs via dint/clippy, runs as a CLI, VS Code extension and GitHub Action, and ships detectors for 20+ vulnerable contracts built from real incidents plus exploit code. The project named Scout provides paired vulnerable/fixed tests, aims to minimize false positives, and reports specific detections (authorization via set_contract_storage, set_code_hash misuse, zero/test address, integer overflows, reentrancy) to reduce auditor effort.
AI-written summary · about
chapters (15)
- 0:00Smart contract security risks
- 1:50Security frameworks reduce risks
- 3:21Scout static analysis tool
- 5:07Scout detects vulnerabilities
- 7:16Rust compiler integration
- 9:23Output formats and IDE integration
- 10:28Case study: authorization bugs
- 12:17Detectors analyze function calls
- 15:06Other vulnerabilities Scout finds
- 17:18Contributing detectors
- 18:46Public test suite
- 19:50Team acknowledgments
- 20:14Q&A: Rust compiler
- 22:42Q&A: Multi-contract attacks
- 24:07Q&A: Documentation
related talks
23mThanks for all the bugs!
23mFrog-Proof Security: Streamlining The Sec In DevSecOps
23mStopping vulnerabilities at the source
13mScaling Smart Contract Security with AI
35mAn intro to the world of auditing Rust code
44mAn intro to improving the security of your code with free analysis tools
30mSmart-Contract Security 201: Auditing Lessons for Solana Founders
52mStructure aware fuzzing