The document discusses challenges in testing smart contracts including: - Black box testing is limited and there are many known attack vectors. - Rapid development and bugs in the Solidity compiler make testing difficult. - The unpredictable blockchain environment also poses challenges. The proposed solution is to: - Thoroughly learn blockchain and Solidity. - Write simple contracts that include known exploits. - Use frameworks like Truffle to write comprehensive autotests. - Lock compiler versions unless critical bugs are found. This approach has led to stable applications over 1.5 years, passed two audits with no vulnerabilities found, comprehensive test coverage, reported compiler bugs, and safely processing over $10M through smart

1. Challenges in testing of Smart
Contracts
Oleksii Matiiasevych

2. Speaker info
Oleksii Matiiasevych
Blockchain Engineer, Ambisafe
•11 years in the IT
•Architect, Developer, QA, Mentor
•Ethereum Evangelist
/in/lastperson
/lastperson

3. Problem
Black Box testing is useless. Dozen known,
domain specific attack vectors. Rapid technology
development. Bugs in the Solidity compiler.
Without knowing and understanding of Smart Contract code, you can only
check positive cases and most obvious negative ones.
New features added regularly, along with new threats being discovered.
Solidity releases includes security bug fixes along with new, and regression,
bugs being introduced.
Unpredictable blockchain environment changes, due to attacks on the
network, core updates, etc.

4. Proposed solution
Learn blockchain, understand its operation on an
advanced level. Learn Solidity, and read
contracts. Cover everything with autotests.
Start with Bitcoin blockchain, it is simpler, and it is the first one. Bitcoin
echoes in every other blockchain out there.
Read through Solidity docs, investigate and digest known attack vectors.
Write simple contracts with exploits, and exploit them.
Use frameworks like Truffle to cover contract code with autotests.
Lock compiler version unless critical bugs found in it.

5. Results
Stable and unharmed live applications for 1.5+
years. Core product codebase passed 2 external
audits with no vulnerabilities detected.
10 lines of autotests per line of code, on average.
Number of compiler bugs reported and neutralized.
10M+ USD safely processed through our smart contracts.
Library of 50+ smart contracts created with confidence.

6. Known attacks
Reentrancy
Timestamp Dependence
Transaction-Ordering Dependence
Integer Overflows/Underflows
Denial-of-Service with Throw
Denial-of-Service with Block Gas Limit

7. Questions
5 minutes.
You can also ask questions for me in the lounge zone