SlideShare a Scribd company logo
Ethereum smart
contract honeypots
Jeff Hu | 2018
Short Intro
• Jeff Hu
• HKUST / Valley / EPFL / J.P. Morgan / Munich
• à Blackbird.ai / SELF CHAIN
• à Founder of Turing Chain Ltd.
Jeff Hu | 2019
Background
• Ethereum
• Programmable blockchain
• Smart Contract
• A set of predefined rules that are immutable
• Honeypots?
• A easy-targeted bait that attackers used to fall for
Jeff Hu | 2018
Honeypots Patterns
• A smart contract with explicit vulnerabilities that attracts the naïve
attackers to launch attack against, whereas which locks up the funds
of the attackers.
Jeff Hu | 2018
Honeypot #1:
Invisible codes!
• Demo
• Intuition: Call GetFreebie()
with ether > 1 to get all the money!
Jeff Hu | 2018
Honeypot #1:
Invisible codes!
• Demo
• Intuition: Call GetFreebie()
with ether > 1 to get all the money!
• Sad fact: Two lines of codes are
hidden by SPACES! The creator get
all the money before any of us does!
Jeff Hu | 2018
Honeypot #2:
Unfair equation!
• Demo
• Intuition: Call multiplicate()
with ether > contract balance to get
all the money!
Jeff Hu | 2018
Honeypot #2:
Unfair equation!
• Demo
• Intuition: Call multiplicate()
with ether > contract balance to get
all the money!
• Sad fact: this.balance will be
increased before checking the
equation, so this.balance will
always LAREGR than msg.value.
(Equation holds when both are zero)
Jeff Hu | 2018
Honeypot #3:
Invisible calls!
• Demo
• Intuition: Check whether the pass
has been set, if not, call
SetPass() with ether >= 1 and
GetGift() to get all the money!
Jeff Hu | 2018
Honeypot #3:
Invisible calls!
• Demo
• Intuition: Check whether the pass
has been set, if not, call
SetPass() with ether >= 1 and
GetGift() to get all the money!
• Sad fact: The creator has already set
the pass with INTERNAL CALL from
another contract, but Etherscan
does NOT show internal call with no
value transferred… Never know…
Jeff Hu | 2018
Honeypot #4:
Useless ownership!
• Demo
• Intuition: Call
useEmergencyCode() to
become the owner to get all the
money!
Jeff Hu | 2018
Honeypot #4:
Useless ownership!
• Demo
• Intuition: Call
useEmergencyCode() to
become the owner to get all the
money!
• Sad fact: The owners of Owned and
TestBank are DIFFERENT! Becoming
the owner of TestBank is useless
bcoz you cannot control the owner
of Owned.
Jeff Hu | 2018
Honeypot #5:
Math trick!
• Demo
• Intuition: Keep calling race() to
transfer money until hitting the aim
of SCORE_TO_WIN to get all the
money!
Jeff Hu | 2018
Honeypot #5:
Math trick!
• Demo
• Intuition: Keep calling race() to
transfer money until hitting the aim
of SCORE_TO_WIN to get all the
money!
• Sad fact: You can never reach 100
finney because of MATH. J
Jeff Hu | 2018
Honeypot #6:
Early termination!
• Demo
• Intuition: Let the iteration rolls and
we will get 2 times the input back!
Jeff Hu | 2018
Honeypot #6:
Early termination!
• Demo
• Intuition: Let the iteration rolls and
we will get 2 times the input back!
• Sad fact: Integer OVERFLOW. var i
is uint8 type, which means that
we will only get 510 wei back. (i.e.
255*2 = 510)
Jeff Hu | 2018
Honeypot #7:
Old compiler!
• Demo
• Intuition: Looks like a normal
contract that is capable of deposit,
calculate dividends, and withdraw.
Nothing weird. (…pondering)
Jeff Hu | 2018
Honeypot #7:
Old compiler!
• Demo
• Intuition: Looks like a normal
contract that is capable of deposit,
calculate dividends, and withdraw.
Nothing weird. (…pondering)
• Sad fact: Visit deployment address
and realize that the compiler is too
old (v0.4.11). The “” mark will be
IGNORED, and thus the target will
switched from us to the owner.
Jeff Hu | 2018
Review
• Honeypot #1: Invisible codes
• Honeypot #2: Unfair equation
• Honeypot #3: Invisible calls
• Honeypot #4: Useless ownership
• Honeypot #5: Math trick
• Honeypot #6: Early termination
• Honeypot #7: Old compiler
Jeff Hu | 2018
DASP: Decentralized Application Security
Project Top 10 of 2018
• https://www.dasp.co
Jeff Hu | 2018
There are more for you to explore!
• Go to Etherscan.io to look for contract examples (or vulnerabilities xd)
• Learn solidity by Crypto Zombies and other resources
• Go to OpenZeppelin to see how the trend goes roughly
• Read smart contract security best practices
Jeff Hu | 2018
Make your contract smart and secure
At least make it a honeypot when you no longer want to secure it :P
Jeff Hu | 2018
Great references
• thec00n: https://github.com/thec00n/smart-contract-honeypots/
• misterch0c: https://github.com/misterch0c/Solidlity-Vulnerable/
• Gerhard Wagner: https://medium.com/@gerhard.wagner/the-
phenomena-of-smart-contract-honeypots-755c1f943f7b
• brenjerman:
https://www.reddit.com/r/ethereum/comments/7xvoui/exposing_et
hereum_honeypots/
• dawu&0x7F: https://paper.seebug.org/631/
Jeff Hu | 2018
Jeff
admin@turingchain.tech
Jeff
Tina
Coming soon…

More Related Content

Similar to Smart Contract Honeypots on Blockchain

The Rise of GameFi
The Rise of GameFiThe Rise of GameFi
The Rise of GameFi
astrooldboy
 
The 30-Month Migration
The 30-Month MigrationThe 30-Month Migration
The 30-Month Migration
glvdb
 
SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...
SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...
SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...
Alan Quayle
 
1024-bit Encrypted, Cloud-Based Garage
1024-bit Encrypted, Cloud-Based Garage1024-bit Encrypted, Cloud-Based Garage
1024-bit Encrypted, Cloud-Based Garagedanieljng
 
From Crypto Kitties to non fungible token to ERC721 standard
From Crypto Kitties to non fungible token to ERC721 standardFrom Crypto Kitties to non fungible token to ERC721 standard
From Crypto Kitties to non fungible token to ERC721 standard
maeste
 
Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...
Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...
Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...
Codemotion
 
Securing Your Bitcoins - Kitten Tofu
Securing Your Bitcoins - Kitten TofuSecuring Your Bitcoins - Kitten Tofu
Securing Your Bitcoins - Kitten Tofu
Bitcoin Barcamp
 
Moving from boxed title Game Development to F2P | Ralf C. Adam
Moving from boxed title Game Development to F2P | Ralf C. AdamMoving from boxed title Game Development to F2P | Ralf C. Adam
Moving from boxed title Game Development to F2P | Ralf C. Adam
Ralf C. Adam
 
ChilliSource PGConnects Master Class
ChilliSource PGConnects Master ClassChilliSource PGConnects Master Class
ChilliSource PGConnects Master Class
taggames
 

Similar to Smart Contract Honeypots on Blockchain (9)

The Rise of GameFi
The Rise of GameFiThe Rise of GameFi
The Rise of GameFi
 
The 30-Month Migration
The 30-Month MigrationThe 30-Month Migration
The 30-Month Migration
 
SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...
SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...
SentryPeer, A distributed list of bad IP addresses and phone numbers collecte...
 
1024-bit Encrypted, Cloud-Based Garage
1024-bit Encrypted, Cloud-Based Garage1024-bit Encrypted, Cloud-Based Garage
1024-bit Encrypted, Cloud-Based Garage
 
From Crypto Kitties to non fungible token to ERC721 standard
From Crypto Kitties to non fungible token to ERC721 standardFrom Crypto Kitties to non fungible token to ERC721 standard
From Crypto Kitties to non fungible token to ERC721 standard
 
Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...
Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...
Webinar: From Crypto Kitties to non fungible token to ERC721 standard - Stefa...
 
Securing Your Bitcoins - Kitten Tofu
Securing Your Bitcoins - Kitten TofuSecuring Your Bitcoins - Kitten Tofu
Securing Your Bitcoins - Kitten Tofu
 
Moving from boxed title Game Development to F2P | Ralf C. Adam
Moving from boxed title Game Development to F2P | Ralf C. AdamMoving from boxed title Game Development to F2P | Ralf C. Adam
Moving from boxed title Game Development to F2P | Ralf C. Adam
 
ChilliSource PGConnects Master Class
ChilliSource PGConnects Master ClassChilliSource PGConnects Master Class
ChilliSource PGConnects Master Class
 

Recently uploaded

DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Ramesh Iyer
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
91mobiles
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 

Recently uploaded (20)

DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 

Smart Contract Honeypots on Blockchain

  • 2. Short Intro • Jeff Hu • HKUST / Valley / EPFL / J.P. Morgan / Munich • à Blackbird.ai / SELF CHAIN • à Founder of Turing Chain Ltd. Jeff Hu | 2019
  • 3. Background • Ethereum • Programmable blockchain • Smart Contract • A set of predefined rules that are immutable • Honeypots? • A easy-targeted bait that attackers used to fall for Jeff Hu | 2018
  • 4. Honeypots Patterns • A smart contract with explicit vulnerabilities that attracts the naïve attackers to launch attack against, whereas which locks up the funds of the attackers. Jeff Hu | 2018
  • 5. Honeypot #1: Invisible codes! • Demo • Intuition: Call GetFreebie() with ether > 1 to get all the money! Jeff Hu | 2018
  • 6. Honeypot #1: Invisible codes! • Demo • Intuition: Call GetFreebie() with ether > 1 to get all the money! • Sad fact: Two lines of codes are hidden by SPACES! The creator get all the money before any of us does! Jeff Hu | 2018
  • 7. Honeypot #2: Unfair equation! • Demo • Intuition: Call multiplicate() with ether > contract balance to get all the money! Jeff Hu | 2018
  • 8. Honeypot #2: Unfair equation! • Demo • Intuition: Call multiplicate() with ether > contract balance to get all the money! • Sad fact: this.balance will be increased before checking the equation, so this.balance will always LAREGR than msg.value. (Equation holds when both are zero) Jeff Hu | 2018
  • 9. Honeypot #3: Invisible calls! • Demo • Intuition: Check whether the pass has been set, if not, call SetPass() with ether >= 1 and GetGift() to get all the money! Jeff Hu | 2018
  • 10. Honeypot #3: Invisible calls! • Demo • Intuition: Check whether the pass has been set, if not, call SetPass() with ether >= 1 and GetGift() to get all the money! • Sad fact: The creator has already set the pass with INTERNAL CALL from another contract, but Etherscan does NOT show internal call with no value transferred… Never know… Jeff Hu | 2018
  • 11. Honeypot #4: Useless ownership! • Demo • Intuition: Call useEmergencyCode() to become the owner to get all the money! Jeff Hu | 2018
  • 12. Honeypot #4: Useless ownership! • Demo • Intuition: Call useEmergencyCode() to become the owner to get all the money! • Sad fact: The owners of Owned and TestBank are DIFFERENT! Becoming the owner of TestBank is useless bcoz you cannot control the owner of Owned. Jeff Hu | 2018
  • 13. Honeypot #5: Math trick! • Demo • Intuition: Keep calling race() to transfer money until hitting the aim of SCORE_TO_WIN to get all the money! Jeff Hu | 2018
  • 14. Honeypot #5: Math trick! • Demo • Intuition: Keep calling race() to transfer money until hitting the aim of SCORE_TO_WIN to get all the money! • Sad fact: You can never reach 100 finney because of MATH. J Jeff Hu | 2018
  • 15. Honeypot #6: Early termination! • Demo • Intuition: Let the iteration rolls and we will get 2 times the input back! Jeff Hu | 2018
  • 16. Honeypot #6: Early termination! • Demo • Intuition: Let the iteration rolls and we will get 2 times the input back! • Sad fact: Integer OVERFLOW. var i is uint8 type, which means that we will only get 510 wei back. (i.e. 255*2 = 510) Jeff Hu | 2018
  • 17. Honeypot #7: Old compiler! • Demo • Intuition: Looks like a normal contract that is capable of deposit, calculate dividends, and withdraw. Nothing weird. (…pondering) Jeff Hu | 2018
  • 18. Honeypot #7: Old compiler! • Demo • Intuition: Looks like a normal contract that is capable of deposit, calculate dividends, and withdraw. Nothing weird. (…pondering) • Sad fact: Visit deployment address and realize that the compiler is too old (v0.4.11). The “” mark will be IGNORED, and thus the target will switched from us to the owner. Jeff Hu | 2018
  • 19. Review • Honeypot #1: Invisible codes • Honeypot #2: Unfair equation • Honeypot #3: Invisible calls • Honeypot #4: Useless ownership • Honeypot #5: Math trick • Honeypot #6: Early termination • Honeypot #7: Old compiler Jeff Hu | 2018
  • 20. DASP: Decentralized Application Security Project Top 10 of 2018 • https://www.dasp.co Jeff Hu | 2018
  • 21. There are more for you to explore! • Go to Etherscan.io to look for contract examples (or vulnerabilities xd) • Learn solidity by Crypto Zombies and other resources • Go to OpenZeppelin to see how the trend goes roughly • Read smart contract security best practices Jeff Hu | 2018
  • 22. Make your contract smart and secure At least make it a honeypot when you no longer want to secure it :P Jeff Hu | 2018
  • 23. Great references • thec00n: https://github.com/thec00n/smart-contract-honeypots/ • misterch0c: https://github.com/misterch0c/Solidlity-Vulnerable/ • Gerhard Wagner: https://medium.com/@gerhard.wagner/the- phenomena-of-smart-contract-honeypots-755c1f943f7b • brenjerman: https://www.reddit.com/r/ethereum/comments/7xvoui/exposing_et hereum_honeypots/ • dawu&0x7F: https://paper.seebug.org/631/ Jeff Hu | 2018