sub0 Asia 2024 - Serhan Bahar and Giovanny Gongora (Parity)
summary
Parity publishes a pragmatic Top 10 from four years of Parity and third‑party audits and parachain engagements and claims most incidents trace to repeatable mistakes. Concrete examples: insecure randomness via CollectiveFlip manipulable by block hash, storage misconfiguration from too‑low existential deposits enabling storage bloat attacks, unsafe arithmetic (overflows, div‑by‑zero) fixed with checked or saturating ops and SP‑arithmetic crates, and lossy EVM→Substrate downcasts that misreport balances. Parity ships a GitHub substrate wargame (red/blue labs), recommends Clippy extensions and automated checks, and aims to translate the framework into CI‑runnable detectors.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 3:11Insecure randomness
- 8:10Storage security risks
- 11:44Unsafe arithmetic
- 17:10Future automation
- 20:45Substrate wargame
- 21:27Q&A
related talks
25mCommSec D2 - Smart Contract (In)Security
20mSolidity's most common security pitfalls and its best safeguards
17mPreview: Security and Privacy
51mA Deal with the Devil: Breaking Smart Contracts
21mOverview of the Last Year of Audits, Reviews, and Proofs
43mOutsmarting Smart Contracts
49mHacked Blockchain Projects What we’ve learned
49mAttacking and Defending Blockchains: From Horror Stories to Secure Wallets