Vulnerabilities of blockchain contracts and Solidity code How good coding practices can limit the scope of security exposure

1. SOLIDITY BEST PRACTICES
BLOCKCHAIN AND SMART
CONTRACTS (SESSION 5)
Hands-on introduction for
Software Developers and
Architects

2. SECURITY RISKS • Security Risks
• Attacks

3. RACE CONDITIONS
Contract A Contract B Contract C Contract A Contract B Contract C

4. RACE CONDITIONS: REENTRANCY
mapping (address => uint) private userBalances;
function withdrawBalance() public {
uint amountToWithdraw =
userBalances[msg.sender];
require(msg.sender.call.value(amountToWithdraw)());
userBalances[msg.sender] = 0;
}
mapping (address => uint) private userBalances
function withdrawBalance() public {
uint amountToWithdraw =
userBalances[msg.sender];
userBalances[msg.sender] = 0;
require(msg.sender.call.value(amountToWithdra
}

5. RACE CONDITIONS: CROSS-FUNCTION
RACE CONDITIONS
mapping (address => uint) private userBalances;
function transfer(address to, uint amount) {
if (userBalances[msg.sender] >= amount) {
userBalances[msg.sender] -= amount;
userBalances[to] += amount;
}
}
function withdrawBalance() public {
uint amountToWithdraw =
userBalances[msg.sender];
require(msg.sender.call.value(amountToWithdraw)
userBalances[msg.sender] = 0;
mapping (address => uint) private userBalances;
function transfer(address to, uint amount) {
if (userBalances[msg.sender] >= amount) {
userBalances[to] += amount;
userBalances[msg.sender] -= amount;
}
}
function withdrawBalance() public {
uint amountToWithdraw =
userBalances[msg.sender];
require(msg.sender.call.value(amountToWithdraw)());
userBalances[msg.sender] = 0;

6. FRONT RUNNING
(TRANSACTION-ORDERING
DEPENDENCE)
Set
Puzzle
Rewar
d
Submi
t
Soluti
on
Updat
e
Puzzle
Rewar
d
Set
Puzzle
Rewar
d
Submi
t
Soluti
on
Updat
e
Puzzle
Rewar
d
Miners can reorder transactions and hence
potentially influence their outcome!

7. REENTRANCY ATTACK

8. UNCHECKED SEND

9. INTEGER OVERFLOW
mapping (address => uint256) public
balanceOf;
function transfer(address _to, uint256
_value) {
/* Check if sender has balance */
require(balanceOf[msg.sender] >=
_value);
/* Add and subtract new balances */
balanceOf[msg.sender] -= _value;
balanceOf[_to] += _value;
}
mapping (address => uint256) public balanceOf
function transfer(address _to, uint256 _value) {
/* Check if sender has balance and for overflo
*/
require(balanceOf[msg.sender] >= _value &&
balanceOf[_to] + _value >= balanceOf[_to]);
/* Add and subtract new balances */
balanceOf[msg.sender] -= _value;
balanceOf[_to] += _value;
}

10. INTEGER UNDERFLOW
function underflow() returns (uint256 _underflow) {
uint256 min = 0;
return min - 1;
}
0 - 1 = 2**256 - 1

11. DENIAL OF SERVICE
address[] private refundAddresses;
mapping (address => uint) public refunds;
function refundAll() public {
for(uint x; x < refundAddresses.length; x++)
{ // arbitrary length iteration based on how
many addresses participated
require(refundAddresses[x].send(refunds[refun
dAddresses[x]])) // doubly bad, now a single
failure on send will hold up all funds
}
}
Contract
A1 A2 A3 A4

12. FORCIBLY SENDING ETHER TO A
CONTRACT
contract Vulnerable {
function () payable {
revert();
}
function somethingBad() {
require(this.balance > 0);
// Do something risky here
}
}

13. BEST PRACTICES

14. AVOID RACE CONDITIONS
someAddress.call(); //Raw call
ExternalContract.someMethod(); //Contract call
Avoid state changes after external calls
Checks
 Who made the call?
 Arguments correct?
 Did they send enough
money?
 …
Updates
Change Internal State
Updates
Call Other Contract(s)

15. EXTERNAL CALLS
Bad Good
Bank.withdraw(100);
function makeWithdrawal(uint amount) {
// Isn't clear that this function is potentially unsafe
Bank.withdraw(amount);
}
UntrustedBank.withdraw(100); // untrusted external call
TrustedBank.withdraw(100); // external but trusted bank contract maintained by XYZ
function makeUntrustedWithdrawal(uint amount) {
UntrustedBank.withdraw(amount);
}

16. AVOID REENTRANCY
UsesomeAddress.send() or
someAddress.transfer()
Bad
Good
someAddress.call.value()() //give all the gas!
someAddress.send()
//or
someAddress.transfer()

17. HANDLE ERRORS
Bad Good
someAddress.send(55);
someAddress.value(55)();
someAddress.value(100)(bytes4(sha3("deposit()")));
if(!someAddress.send(55)) {
// Some failure code
}
ExternalContract(someAddress).deposit.value(100);

18. FAVOR PULL OVER PUSH
Bad Good
contract auction {
address highestBidder;
uint highestBid;
function bid() payable {
require(value >= highestBid);
if (highestBidder != 0) {
highestBidder.transfer(highestBid); // if this call
consistently fails, no one else can bid }
highestBidder = sender;
highestBid = value;
} }
contract auction {
address highestBidder;
uint highestBid;
mapping(address => uint) refunds;
function bid() payable external {
require(value >= highestBid);
if (highestBidder != 0) {
refunds[highestBidder] += highestBid; // record the
}
highestBidder = sender;
highestBid = value;
}
function withdrawRefund() external {
uint refund = refunds[sender];
refunds[sender] = 0;
.sender.transfer(refund);
}
}

19. ASSERT
Assert often. Create smart asserts
contract Token {
mapping(address => uint);
public balanceOf;
uint public totalSupply;
function deposit() public payable {
balanceOf[msg.sender] += msg.value;
totalSupply += msg.value;
assert(this.balance>= totalSupply);
}
}

20. REQUIRE Require arguments
pragma solidity ^0.4.0;
contract Sharer {
function sendHalf(address addr) public payable returns (uint
balance) {
require(msg.value % 2 == 0); // Only allow even numbers
uint balanceBeforeTransfer = this.balance;
addr.transfer(msg.value / 2);
// Since transfer throws an exception on failure and
// cannot call back here, there should be no way for us to
// still have half of the money.
assert(this.balance == balanceBeforeTransfer - msg.value
/ 2);
return this.balance;
}
}

21. AVOID ROUNDING ERRORS
ERRORS
Bad
uint x = 5 / 2; contract Divide {
function getDivided(uint numerator, uint
denominator) public constant returns(uint
quotient, uint remainder) {
quotient = numerator / denominator;
remainder = numerator - denominator *
quotient;
}
}

22. KEEP FALLBACK FUNCTIONS
SIMPLE
Bad Good
function() payable { balances[msg.sender] += msg.value; }
function deposit() payable external {
balances[msg.sender] += msg.value;
}
function() payable { deposit(msg.sender); }

23. MARK VISIBILITY IN FUNCTIONS AND
VARIABLES
Bad
Good
uint x; // the default is internal
function buy() { // the default is public
// public code
}
uint private y;
function buy() external {
// only callable externally
}
function utility() public {
// callable externally, as well as internally: changing this code
requires thinking about both cases.
}
function internalAction() internal {
// internal code
}

24. LOCK COMPILER VERSION
Bad Good
pragma solidity ^0.4.4;
pragma solidity 0.4.4;

25. DIFFERENTIATE FUNCTIONS AND
EVENTS
Bad Good
event Transfer() {}
function transfer() {}
event LogTransfer() {}
function transfer() external {}

26. USER NEW CONSTRUCTS
Bad Good
suicide()
sha3()
selfdestruct()
keccak256()

27. UNDERSTAND MULTIPLE
INHERITANCEcontract Final {
uint public a;
function Final(uint f) public {
a = f;
}
}
contract B is Final {
int public fee;
function B(uint f) Final(f) public {
}
function setFee() public {
fee = 3;
}
}
contract C is Final {
int public fee;
function C(uint f) Final(f) public {
}
function setFee() public {
fee = 5;
}
}
contract A is B, C {
function A() public B(3) C(5) {
setFee();
}
}

28. UNDERSTAND 3 WAYS OF SENDING
ETHER
address.send() address.transfer(
)
address.call.valu
e()()
contract Sender {
function send(address _receiver) payable {
_receiver.send(msg.value);
}
}
contract Receiver {
uint public balance = 0;
event Receive(uint value);
function () payable {
Receive(msg.value);
}
}
contract Sender {
function send(address _receiver) payable {
_receiver.transfer(msg.value);
}
}
contract Receiver {
uint public balance = 0;
event Receive(uint value);
function () payable {
Receive(msg.value);
}
}
contract Sender {
function send(address _receiver) payable {
_receiver.call.value(msg.value).gas(20317)();
}
}
contract Receiver {
uint public balance = 0;
function () payable {
balance += msg.value;
}
}
• Can not set gas
limit
• Returns false on
error
• Can not set gas
limit
• Exception on
error
• Can set gas limit
• Exception on
error

29. MISCELLANEOUS SUGGESTIONS
Don't assume contracts are created with zero balance
Remember that on-chain data is public
Be aware that players can “drop out”
Remember that Block.timestamp can be manipulated
Include a Fail-Safe Mode

30. NEXT STEP
https://capturetheether.com/

31. STAY IN TOUCH
Gene Leybzon https://www.linkedin.com/in/leybzon/
https://www.meetup.com/members/90744
20/
https://www.leybzon.com