Talk on smart contract security at the CyberJourney event organized in Cagliari by Pluribus One and Owasp. The talk focus is on smartcontract vulnerability and countermeasures to mitigate or eliminate the surface of attacks. It is also described the process of security audit

1. #cyberjourney www.cyberjourney.it
DavideCarboni,PhD
Secure coding and auditing of smart contracts

2. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 2

3. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 3

4. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 4
WhySmartContractssecurity
isproblematic?

5. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
(sourceDeFiLlama)
5

6. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
"Smart contracts on Ethereum
are worse than even non-
financial commercial code; as of
May 2016, Ethereum contracts
averaged 100 obvious bugs [...]
per 1000 lines of code. For
comparison, Microsoft code
averages 15 bugs per 1000
lines, NASA code around 0 per
500,000 lines."
6

7. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 7
Smart contracts are self-executing programs
that run on a blockchain. They allow for the
automation of complex transactions and
eliminate the need for intermediaries,
making them faster, cheaper, and more
secure than traditional contracts.
Unlike traditional code, smart contracts are
immutable, meaning they cannot be altered
once deployed on the blockchain. This
ensures that all parties involved in the
transaction can trust that the terms of the
contract will be executed as written
(ChatGPT3.5)

8. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 8
smart contracts
are not smart
neither contracts
(various since 2016)

9. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 9
SPOILER:Itisnotapaymenttobuygoodsandservices
What is a transaction

10. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 10
GlobalState(T0)
Transaction
GlobalState(T1)
duringatransactionyoupaythegasfeetogetinexchangeachangeoftheglobalchangeoftheblockchain
TIME

11. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 11
node
node
node
node
node
node
node
node
node
CODE LOCALLY COMPILE LOCALLY RUN GLOBALLY
Smart Contracts cannot be stopped unless their
design includes some roles for control and admin

12. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 12
Offchain traditional software Smart contract
Denial of
service
Loss grows linearly with the time of
recovery
No DoS, but gas fees can grow
(a lot)
Data leakage Hackers can resell data There is no private data in
smart contracts
Data
corruption
Loss proportional to the time to
recover (if there is a backup)
Data corruption IS THE LOSS
Ransom Loss is based on pay-per-recover,
recover no guaranteed
Not applicable

13. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
Someremarkablehacks
13
Name:TheDAOHack
Type:Reentrancy
Year:2016
Loss:$70M
Countermeasure:Ethereumrollbackvia
hardfork

14. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
Someremarkablehacks(2)
14
Name:Paritymultisigwallet
Type:Delegatecall
Year:2017
Loss:$30-100M+(unverified)
Countermeasure:None,hardforknot
agreed

15. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
Codereentrancy
Reentrancy can occur when a program or contract makes a
call to another program or contract and then continues to
execute
15

16. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
Flashloan(legituse:arbitrage)
16
Lend $1M USDC Swap USDC/DAI
rate 1.05
Swap DAI/USDC
rate 1.0
Repay the loan
(profit = $50K)
Allinasingletransaction,makeorbreak.Yougetaprofitof5%withoutstakinganycollateral
Ifsomethingfailsthestaterevertstopreviousstate,noriskforthelenders
1 2 3 4

17. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
UseaFlashloanasleveragetoamplifyanothervulnerability
17
Exploits a
vulnerability
Take a Flash Loan Repay the loan
Repeat

18. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
SomeremarkableFlashloansattacks
18

19. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
UnsafetransferinERC20tokens
19
Whatifthetransfercannot
happenforlackofbalance?
ERC20standardsmandatesto
returnfalse
Unfortunately,therearemany
tokensthatdonotcomply(USDT,
BNB,...)

20. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
HowtomitigateERC20unsafetransfer?
20
Using the OpenZeppelin safeERC20 library is a way to go

21. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
NFTEditablemetadata
21
Your
NFT
Your
NFT
Link to bitmap
Your
NFT
Link to bitmap
Some
Web
server
A quest for Availability, Integrity, Immutability

22. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
https://swcregistry.io/
22

23. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 23
So, why audits?
or external code review

24. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 24
Before starting
A checklist
Repository & Versioning
No duplicated code
Well documented dependencies
No compile warnings
Testcases, coverage
100%

25. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 25
The triage
Risk = Prob * Damage

26. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 26
The workflow
A game between auditors and developers

27. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 27
Tools
Solidity code analyzer Toolkit for Fuzz testing, Invariant testing,
Gas tracking and much more Solidity Visual Developer
by Consensys
A Visual Studio plugin

28. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 28
Which auditor fits you best
Solo Firm Bounty

29. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney 29
Resources
github.com/tamjid0x01
smartcontract.tips

30. CyberJourney–June22,2023,Cagliari,Italy
#cyberjourney
LESSONSLEARNED
KEEPTHECODEASSIMPLEASPOSSIBLE,DELEGATECOMPLEXITYTOOFF-CHAINCODE
USESTANDARDCONTRACTSFROMEIPREGISTRYANDBATTLETESTEDIMPLEMENTATIONS
GRASPTHE RUNTIMEMODELOFEVMINALLSUBTLETIESANDTHINKTHATEVERYCPUCYCLEORBYTEUSEDISLIKE MONEYINPREPAID
CARD.IF GASLIMITISHIT YOUHAVENOTRANSACTIONDONEANDNOMONEYBACK
30

31. #cyberjourney www.cyberjourney.it
@digitaldavide
davide@uniscrow.com
Thankyouforyourattention