Making smart contract smarter Loi Luu, Duc-Hiep Chu, Hrishi Olickel, - - PowerPoint PPT Presentation

β–Ά
making smart contract smarter
SMART_READER_LITE
LIVE PREVIEW

Making smart contract smarter Loi Luu, Duc-Hiep Chu, Hrishi Olickel, - - PowerPoint PPT Presentation

Nov 30, 2022 524 likes β€’1.4k views

Making smart contract smarter Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena, Aquinas Hobor <EE817/IS893: Blockchain and Cryptocurrency> Presented by Daejun Kim (2019. 05) Index Background Introduction Security bugs in

slide-1
SLIDE 1

Making smart contract smarter

Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena, Aquinas Hobor

<EE817/IS893: Blockchain and Cryptocurrency> Presented by Daejun Kim (2019. 05)

slide-2
SLIDE 2

Index

  • Background
  • Introduction
  • Security bugs in Ethereum
  • Towards a better design
  • The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool (compare with teEther)
  • Conclusion
  • Future Works
  • Appendix

2 / 74

slide-3
SLIDE 3

Background

3 / 74

slide-4
SLIDE 4

Trend

  • Academic Pedigree

*Image from Narayanan, Arvind, and Jeremy Clark. "Bitcoin's academic pedigree." Communications of the ACM 60.12 (2017): 36-45.

4 / 74

slide-5
SLIDE 5

Trend

[2016]

  • Luu, Loi, Duc-Hiep Chu, Hrishi Olickel, Prateek Saxena and Aquinas Hobor.

"Making smart contracts smarter." ACM CCS. [2017]

  • Trailofbits, https://github.com/trailofbits/manticore
  • Trailofbits, https://github.com/ConsenSys/mythril-classic

5 / 74

slide-6
SLIDE 6

Trend

[2018] - Cont’d

  • Yi Zhou, Deepak Kumar, Surya Bakshi, Joshua Mason, Andrew Miller, and Mi

chael Bailey. "Erays: reverse engineering ethereum's opaque smart contracts.β€œ, USENIX

  • Sukrit Kalra, Seep Goel, Mohan Dhawan and Subodh Sharma. "Zeus: Analyz

ing safety of smart contracts.β€œ, NDSS

  • Krupp Johannes, and Christian Rossow. "teether: Gnawing at ethereum to a

utomatically exploit smart contracts.β€œ, USENIX

6 / 74

slide-7
SLIDE 7

Trend

[2018]

  • Tsankov, P

., Dan, A., Drachsler-Cohen, D., Gervais, A., Buenzli, F., & Vechev,

  • M. β€œSecurify: Practical security analysis of smart contracts.” ACM SIGSAC
  • Tikhomirov, S., Voskresenskaya, E., Ivanitskiy, I., Takhaviev, R., Marchenko, E.,

& Alexandrov, Y. β€œSmartcheck: Static analysis of ethereum smart contracts.”. WETSEB

7 / 74

slide-8
SLIDE 8

Trend

*Image from β€œSmart Contract 뢄석과 PL”, Jonghyup Lee

  • Symbolic Execution (This paper also uses the same methodology.)
  • Slow…. But, targeting smart contracts is fast!

8 / 74

slide-9
SLIDE 9

Ethereum

  • β€œEthereum is an open blockchain platform that lets anyone build and

use decentralized applications that run on blockchain technology.” (aka. 2nd generation cryptocurrency)

It can be a platform! <Smart contract>

Issued date

  • 2015. 07.

Market capitalization β‰ˆ$18 billion (2019. 04) Block Time About 12 seconds Block reward 5 ETH (Ethereum) Consensus Algorithm PoW

*Market capitalization from Coinmarketcap (https://coinmarketcap.com)

9 / 74

slide-10
SLIDE 10

Smart contract

  • β€œA smart contract is a computerized transaction protocol that executes

the terms of a contract.” (Szabo, Nick. "Smart contracts." Unpublished manuscript (1994))

  • Today, this is also called DApp (Decentralized application, Distributed

application)

$ Alice Bob

10 / 74

slide-11
SLIDE 11

Smart contract

  • In Ethereum (Cont’d)
  • This program is run on block-chain nodes.
  • Executed on incoming transactions
  • from, to, value (ETH amount), gas (fee), data (argv)
  • β€œConceptually, Ethereum can be viewed as a transaction based

state-machine”

  • Turing complete (Turing, Alan. "On Computable Numbers, with an

Application to the Entscheidungs problem, 1936." B. Jack Copeland (2004): 58.)

11 / 74

slide-12
SLIDE 12

Smart contract

  • In Ethereum
  • Written in solidity
  • object-oriented, high-level language for implementing smart

contracts

  • influenced by C++, Python and JavaScript and is designed to

target the Ethereum Virtual Machine (EVM).

  • Usage
  • voting, crowdfunding, blind auctions, and multi-signature wallets.
  • Cannot patch

12 / 74

slide-13
SLIDE 13

Smart contract

  • Gas (Cont’d)
  • β€œGas is a unit that measures the amount of computational effort that

it will take to execute certain operations.”

$ + (gas) Alice Bob

13 / 74

slide-14
SLIDE 14

Smart contract

  • Gas (Cont’d)
  • Fee (Gas) = Gas limit * Gas price (FYI. 1 ETH = 1,000,000,000 𝑕π‘₯𝑓𝑗)
  • Gas Limit: Number of gases required for operation
  • Gas Price: Literally, gas price.
  • Affects mining time / order.

π‘ˆ

𝑏

β‰ˆ 𝑁𝑏𝑦 β‰ˆ π‘π‘—π‘œ π‘ˆπ‘ 𝑑𝑣𝑗𝑒

If 𝑑𝑏𝑛𝑓 𝐻𝑏𝑑 𝑄𝑠𝑗𝑑𝑓, Gas Limit comparison

π‘ˆ

𝑏

1 βˆ— 109 π‘ˆπ‘ 2 βˆ— 109

If 𝑑𝑏𝑛𝑓 𝐻𝑏𝑑 𝑀𝑗𝑛𝑗𝑒, Gas Price comparison

14 / 74

slide-15
SLIDE 15

Smart contract

  • Gas
  • But, You do not consume too much gas in one transaction.
  • Block Gas Limit: The sum of the gases that can be contained in a

block.

  • If fails, the state (Οƒ) is reverted to the initial state and the sender

pays all gas limit to the miner. (counter-measure against resource- exhausting attacks)

(gas consume) Alice Bob

Fail

15 / 74

slide-16
SLIDE 16

Smart contract

  • Ethereum Virtual Machine (EVM)

EVM Code on Blockchain Program Counter Gas Stack 256 bits * 1024 Memory linear memory Storage key-value store (256 – 256 bits) Persistent Volatile

16 / 74

slide-17
SLIDE 17

Smart contract

  • Ethereum Virtual Machine (EVM)
  • No register
  • Stack: PUSH/POP/COPY/SWAP
  • Memory: MSTORE/MLOAD
  • Storage: SSTORE/SLOAD
  • Gas consumes per opcode.

EVM Code example Byte Code | Assembly ================== 6009 | PUSH1 09 34 | CALLVALUE 6007 | PUSH1 07 57 | JUMPI 00 | STOP 5b | JUMPDEST 56 | JUMP 5b | JUMPDEST 00 | STOP

Gas consumes

*Gas consumes: https://docs.google.com/spreadsheets/d/1n6mRqkBz3iWcOlRem_mO09GtSKEKrAsfO7Frgx18pNU/edit

17 / 74

slide-18
SLIDE 18

Introduction

18 / 74

slide-19
SLIDE 19

Introduction

  • Goal & Approach: Finding bugs in Ethereum Smart Contract via

symbolic execution tool.

19 / 74

slide-20
SLIDE 20

Introduction

  • Contribution
  • Introducing several new classes of security bugs in the Ethereum

Smart Contract

  • Formalize the β€œlightweight” semantics of Ethereum smart contract

and propose recommendations as solutions for the documented bugs.

  • make & run π‘ƒπ‘§π‘“π‘œπ‘’π‘“, a symbolic execution tool which analyses

Ethereum smart contracts to detect bugs, in real Ethereum network.

20 / 74

slide-21
SLIDE 21

Introduction

  • Comparison (π‘ƒπ‘§π‘“π‘œπ‘’π‘“ vs π‘Žπ‘“π‘£π‘‘)
  • Kalra, Sukrit, et al. "Zeus: Analyzing safety of smart contracts." 25th

Annual Network and Distributed System Security Symposium, NDSS. 2018. Transaction Order Dependence Block / Transaction state dependence Unchecked send Reentrancy Failed send Integer overflow / underflow 8,890 / 19,366 (45.9%, 1,758 unique contract) 21,281 / 22,493 (94.6%, 1,524 unique contract)

21 / 74

slide-22
SLIDE 22

Security bugs in Ethereum

22 / 74

slide-23
SLIDE 23

Security bugs in Ethereum

Attack #1. Transaction-Ordering Dependence (TOD)

  • Did you remember the transaction ordering?
  • OK, Let’s think about the following situation.

π‘ˆ

𝑏

β‰ˆ 𝑁𝑏𝑦 β‰ˆ π‘π‘—π‘œ π‘ˆπ‘ 𝑑𝑣𝑗𝑒 If 𝑑𝑏𝑛𝑓 𝐻𝑏𝑑 𝑄𝑠𝑗𝑑𝑓, Gas Limit comparison π‘ˆ

𝑏

1 βˆ— 109 π‘ˆπ‘ 2 βˆ— 109 If 𝑑𝑏𝑛𝑓 𝐻𝑏𝑑 𝑀𝑗𝑛𝑗𝑒, Gas Price comparison Alice Bob (???) Who’s first?

23 / 74

slide-24
SLIDE 24

Security bugs in Ethereum

Attack #1. TOD

  • Let's take a specific example.
  • In this contract, you can get a reward

when you send the right answer.

24 / 74

slide-25
SLIDE 25

Security bugs in Ethereum

Attack #1. TOD - Example

Alice π»π‘π‘‘π‘žπ‘ π‘—π‘‘π‘“ = 1 βˆ— 109 I found the answer! It is 96

25 / 74

slide-26
SLIDE 26

Security bugs in Ethereum

Attack #1. TOD - Example

Alice I found the answer! It is 96 π»π‘π‘‘π‘žπ‘ π‘—π‘‘π‘“ = 1 βˆ— 109 Bob

<Blockchain info> Alice: I found the answer! It is 96 (1) Read ASAP 2 π»π‘π‘‘π‘žπ‘ π‘—π‘‘π‘“ = πŸ‘ βˆ— 109

96 Bob is first.

26 / 74

slide-27
SLIDE 27

<Blockchain info> Alice: I found the answer! It is 96

Security bugs in Ethereum

Attack #1. TOD - Example

Alice I found the answer! It is 96 π»π‘π‘‘π‘žπ‘ π‘—π‘‘π‘“ = 1 βˆ— 109 Bob 96 Bob is first. Bob or Bob’s partner

(1) Read ASAP 2 π»π‘π‘‘π‘žπ‘ π‘—π‘‘π‘“ = 𝟐 βˆ— 109

27 / 74

slide-28
SLIDE 28

Security bugs in Ethereum

Attack #2. Timestamp Dependence

  • The timestamp of the

block is used to create a random value.

28 / 74

slide-29
SLIDE 29

Security bugs in Ethereum

Attack #2. Timestamp Dependence

  • The timestamp of the

block is used to create a random value.

  • local time manipulation

with pre-computed value (Randomness)

Bob or Bob’s partner

block.timestamp <= now + 900 && block.timestamp >= parent.timestamp

29 / 74

slide-30
SLIDE 30

Security bugs in Ethereum

Attack #2. Timestamp Dependence

  • The timestamp of the

block is used to create a random value.

  • local time manipulation

with pre-computed value (Randomness)

*Info ref. Wood, Gavin. "ETHEREUM: A SECURE DECENTRALISED GENERALISED TRANSACTION LEDGER BYZANTIUM VERSION." Internet: https://github. com/ethereum/yellowpaper,[Apr. 17, 2019] (2019). *geth is the the command line interface for running a full ethereum node implemented in Go (https://github.com/ethereum/go-Ethereum)

block.timestamp <= now + 900 && block.timestamp >= parent.timestamp

Allow only 15 seconds. (geth code: consensys.go) There is no time limit.

  • ref. from outdated whitepaper 

cuz of 3 years ago paper 

Bob or Bob’s partner

30 / 74

slide-31
SLIDE 31

Security bugs in Ethereum

Attack #2. Timestamp Dependence

  • The timestamp of the

block is used to create a random value.

  • local time manipulation

with pre-computed value (Randomness)

*Info ref. Wood, Gavin. "ETHEREUM: A SECURE DECENTRALISED GENERALISED TRANSACTION LEDGER BYZANTIUM VERSION." Internet: https://github. com/ethereum/yellowpaper,[Apr. 17, 2019] (2019). *geth is the the command line interface for running a full ethereum node implemented in Go (https://github.com/ethereum/go-Ethereum)

block.timestamp <= now + 900 && block.timestamp >= parent.timestamp

Allow only 15 seconds. (parity code: verification.rs)

Bob or Bob’s partner

There is no time limit.

  • ref. from outdated whitepaper 

cuz of 3 years ago paper 

31 / 74

slide-32
SLIDE 32

Security bugs in Ethereum

Attack #3. Mishandled Exception

32 / 74

slide-33
SLIDE 33

Security bugs in Ethereum

Attack #3. Mishandled Exception

  • send reward ->

assign the new king

$

33 / 74

slide-34
SLIDE 34

Security bugs in Ethereum

Attack #3. Mishandled Exception

  • send reward ->

assign the new king

  • 27.9% of the contract do not

check the return values after calling other contracts via send.

Revert (out of gas)

34 / 74

slide-35
SLIDE 35

Security bugs in Ethereum

Attack #4. Reentrancy Vulnerability

  • In Ethereum, when a contract calls another, the current execution

waits for the call to finish.

*code from https://hackernoon.com/smart-contract-security-part-1-reentrancy-attacks-ddb3b2429302

35 / 74

slide-36
SLIDE 36

Security bugs in Ethereum

Attack #4. Reentrancy Vulnerability

  • The DAO Hack
  • Most well-known smart contract vulnerability.
  • The hacker stole over 3,600,000 ETH / 60,000,000 USD

*code from (TheDAO) https://etherscan.io/address/0xbb9bc244d798123fde783fcc1c72d3bb8c189413#code

splitDAO(proposal, address) withdrawRewardFor(msg.sender) rewardAccount.payout(_account, reward) balances[msg.sender] = 0;

<Attacker> DAO.splitDao(proposal, address)

36 / 74

slide-37
SLIDE 37

Towards a better design

37 / 74

slide-38
SLIDE 38

Towards a better design

  • Operational Semantics of Ethereum

Blocks Transactions

38 / 74

slide-39
SLIDE 39

Towards a better design

  • Transaction Execution

$ Alice Bob

𝜏 πœβ€²β€² 𝜏 πœβ€²β€²

39 / 74

slide-40
SLIDE 40

Towards a better design

  • Recommendations for Better Semantics - Overview
  • Guard transactions
  • 𝑕 : guard condition
  • TX-Stale: current state 𝜏 needs to satisfy 𝑕 for the execution of π‘ˆ

40 / 74

slide-41
SLIDE 41

Towards a better design

  • Recommendations for Better Semantics - TOD
  • Guard transactions
  • 𝑕 : guard condition
  • TX-Stale: current state 𝜏 needs to satisfy 𝑕 for the execution of π‘ˆ

Owner’s π‘ˆb updatePrice() Higher price Userβ€²s π‘ˆ

a buy()

Vulnerable! (1) (2) Block #1

41 / 74

slide-42
SLIDE 42

Towards a better design

  • Recommendations for Better Semantics - TOD
  • Guard transactions
  • 𝑕 : guard condition
  • TX-Stale: current state 𝜏 needs to satisfy 𝑕 for the execution of π‘ˆ

Owner’s π‘ˆb updatePrice() Higher price Userβ€²s π‘ˆ

a buy()

𝑕 ≑ (Value = Price) Safety (1) (2) Block #1

42 / 74

slide-43
SLIDE 43

Towards a better design

  • Recommendations for Better Semantics – Timestamp Dependence
  • Deterministic Timestamp
  • block timestamp is essentially a redundant feature
  • a new block is created

approximately every 12 seconds in Ethereum

  • block.timestamp (X)
  • block number (O)

43 / 74

slide-44
SLIDE 44

Towards a better design

  • Recommendations for Better Semantics – Mishandled exception
  • Better exception handling
  • β€œMake & Use Try-catch”
  • Info: catching exceptions is not

yet possible in Solidity.

*Code from https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/try...catch *info from https://solidity.readthedocs.io/en/v0.5.7/control-structures.html#error-handling-assert-require-revert-and-exceptions

44 / 74

slide-45
SLIDE 45

Towards a better design

  • Recommendations for Better Semantics – Mishandled exception
  • Error Handling.

*info from https://solidity.readthedocs.io/en/v0.5.7/units-and-global-variables.html#error-handling

45 / 74

slide-46
SLIDE 46

Towards a better design

  • Recommendations for Better Semantics
  • Reentrancy Vulnerability (Not covered in this paper.)
  • Call after update.

*code from https://hackernoon.com/smart-contract-security-part-1-reentrancy-attacks-ddb3b2429302

46 / 74

slide-47
SLIDE 47

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

Compare with teEther

Krupp, Johannes, and Christian Rossow. "teether: Gnawing at ethereum to automatically exploit smart contracts." 27th USENIX Security Symposium. 2018.

47 / 74

slide-48
SLIDE 48

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • How to solve the problem in smart contract?
  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ : An analysis tool for smart contract based

upon symbolic execution

  • developers to write better contracts
  • users to avoid invoking problematic contracts
  • y = Ξ», x = Ο‡
  • (𝑨 β‰  1000) : ((Ο‡ * 2) β‰  1000)
  • (𝑨 = 1000, 𝑧 ≀ 𝑨) : (((Ο‡ * 2) = 1000) && Ξ» ≀ (Ο‡ * 2))
  • (𝑨 = 1000, 𝑧 > 𝑨) : (((Ο‡ * 2) = 1000) && Ξ» > (Ο‡ * 2))
  • Symbolically executing all feasible program paths

does not scale to large programs. (But, targets of π‘ƒπ‘§π‘“π‘œπ‘’π‘“ are smart contracts)

*Code from https://www.lazenca.net/pages/viewpage.action?pageId=6324534

48 / 74

slide-49
SLIDE 49

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • Z3
  • An efficient SMT Solver

49 / 74

slide-50
SLIDE 50

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘ 
  • The attacker of this paper is a weak attacker
  • The goal is to find a contract in which the

attacker can call the money-related instruction

  • Ex. SELFDESTRUCT(address): sends all of the

contract’s current balance to address

  • Make Exploit automatically.

50 / 74

slide-51
SLIDE 51

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Overview

51 / 74

slide-52
SLIDE 52

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • Overview

*Krupp, Johannes, and Christian Rossow. "teether: Gnawing at ethereum to automatically exploit smart contracts." 27th {USENIX} Security Symposium ({USENIX} Security 18). 2018.

52 / 74

slide-53
SLIDE 53

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • CFG Recovery
  • 64 EVM Instructions.
  • Block => Node
  • Jump => Edge

F T F T T F F T

6060604052123123123528.....

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

53 / 74

slide-54
SLIDE 54

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • CFG Recovery

JUMPDEST JUMPI JUMP

unconditional jump conditional jump Markers jump target 3460576060565b606060565b 50565b00151600…

*Image from β€œteether: Gnawing at ethereum to automatically exploit smart contracts (slide pptx)”, Johannes.krupp@cispa, USENIX 2018

54 / 74

slide-55
SLIDE 55

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Execution Trace (Explorer)
  • DFS (Depth Frist Search)

F T F T T F F T

6060604052123123123528.....

T T F T

𝑦 𝐷1: 𝑦 > 0 𝐷2: 𝑨 <15 𝐷3:z<8 𝑨 = 𝑦 + 2;

𝐷1 β‹€ 𝐷2 β‹€ 𝐷3β‹€(z = x + 2)

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

55 / 74

slide-56
SLIDE 56

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Theorem Prover
  • Each trace is associated

with a path constraint and auxiliary data that the analyses in later phase require.

  • Z3 in particular, helps us

eliminate provably infeasible traces from consideration.

F T F T T F F T

6060604052123123123528.....

T T F T

𝑦 𝐷1: 𝑦 > 0 𝐷2: 𝑨 <15 𝐷3:z<8 𝑨 = 𝑦 + 2;

𝐷1 β‹€ 𝐷2 β‹€ 𝐷3β‹€(z = x + 2) π‘Ž3

False True 𝑦 = 10

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

56 / 74

slide-57
SLIDE 57

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • Path generation
  • Wait!
  • There are some

challenges.

3460576060565b606060565b 50565b00151600…

π‘Ž3

*Image from β€œteether: Gnawing at ethereum to automatically exploit smart contracts (slide pptx)”, Johannes.krupp@cispa, USENIX 2018

CRITICAL = ['CALL', 'DELEGATECALL', 'CALLCODE', 'SELFDESTRUCT']

57 / 74

slide-58
SLIDE 58

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • Path generation – Challenge #1. Contract state

*Image from β€œteether: Gnawing at ethereum to automatically exploit smart contracts (slide pptx)”, Johannes.krupp@cispa, USENIX 2018

58 / 74

slide-59
SLIDE 59

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • Path generation – Challenge #1. Contract state

(1) mark SSTORE instructions (2) compute backward slices of argument(s) (3) generate path through a slice (4) execute path symbolically (collect path constraints)

  • collect storage reads R & write W
  • combine states changing paths + 1 critical path

*Image from β€œteether: Gnawing at ethereum to automatically exploit smart contracts (slide pptx)”, Johannes.krupp@cispa, USENIX 2018

59 / 74

slide-60
SLIDE 60

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • Path generation – Challenge #2. Hash Functions
  • EVM has SHA hash instructions.
  • Hash is a one-way function.
  • If the hash function is in the constraints, it is impossible to solve.

*Image from β€œteether: Gnawing at ethereum to automatically exploit smart contracts (slide pptx)”, Johannes.krupp@cispa, USENIX 2018

60 / 74

slide-61
SLIDE 61

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘’π‘“πΉπ‘’β„Žπ‘“π‘  Architecture
  • Path generation – Challenge #2. Hash Functions

(1) Remove dependent constraints (2) Solve reduced set (3) Compute hash values (4) Replace dependent constraints (5) Repeat.

*Image from β€œteether: Gnawing at ethereum to automatically exploit smart contracts (slide pptx)”, Johannes.krupp@cispa, USENIX 2018

61 / 74

slide-62
SLIDE 62

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Transaction Ordering Dependence
  • [Remind]
  • Explorer: Returns a set of traces and the corresponding Ether

flow for each trace.

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

62 / 74

slide-63
SLIDE 63

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • if two different traces have different Ether flows => Vulnerable!
  • 1. Trace & Ether flow.
  • 2. Trace & Ether flow.

F T F T T F F T

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

63 / 74

slide-64
SLIDE 64

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Timestamp Dependency
  • Symbolize block.timestamp on Explorer. (Ex, πœ„)
  • if this symbolic variable is included.

A contract is flagged as timestamp-dependent vulnerability.

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

F T F T T F F T

πœ„

64 / 74

slide-65
SLIDE 65

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Mishandled Exception (send)

Caller Callee CALL Contract … … … EVM Code … … … … … Stack …

65 / 74

slide-66
SLIDE 66

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Mishandled Exception (send)
  • Safety

Caller Callee CALL Contract ISZERO … … EVM Code … … … … … Stack Failed!

66 / 74

slide-67
SLIDE 67

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Mishandled Exception (send)
  • Vulnerable

Caller Callee CALL Contract … … … EVM Code … … … … … Stack Failed!

67 / 74

slide-68
SLIDE 68

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Reentrancy Detection
  • At each CALL that is encountered, they obtain the path condition for

the execution before the CALL is executed.

  • check if such condition with updated variables (e.g., storage values)

still holds (i.e., if the call can be executed again)

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

68 / 74

slide-69
SLIDE 69

The π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Tool

  • π‘ƒπ‘§π‘“π‘œπ‘’π‘“ Architecture
  • Core analysis – Reentrancy Detection

splitDAO(proposal, address) withdrawRewardFor(msg.sender) rewardAccount.payout(_account, reward) balances[msg.sender] = 0;

Vulnerable

F T F T T F F T

*Image from β€œMaking Smart Contracts Smarter: Oyente – Loi Luu (slide pptx)”, Devcon 2016

69 / 74

slide-70
SLIDE 70

Conclusion

70 / 74

slide-71
SLIDE 71

Conclusion

  • 19,336 Smart contracts (Mainnet)
  • Open-source! (π‘ƒπ‘§π‘“π‘œπ‘’π‘“)
  • but for ethical reasons we do not conduct our attack confirmation on

contracts

  • False-Positive: Validator is far from being complete

Detected TheDAO bug

71 / 74

slide-72
SLIDE 72

Conclusion

  • Contribution
  • Introducing several new classes of security bugs in the Ethereum

Smart Contract

  • Formalize the β€œlightweight” semantics of Ethereum smart contract

and propose recommendations as solutions for the documented bugs.

  • make & run π‘ƒπ‘§π‘“π‘œπ‘’π‘“, a symbolic execution tool which analyses

Ethereum smart contracts to detect bugs, in real Ethereum network.

72 / 74

slide-73
SLIDE 73

Future Works

73 / 74

slide-74
SLIDE 74

Future Works

  • Design defects due to component combination.

Smart contract User Node General Language Logic Consensus Wallet

74 / 74

slide-75
SLIDE 75

END.

Thanks.

slide-76
SLIDE 76

Appendix

slide-77
SLIDE 77

Appendix - Towards a better design

  • Operational Semantics of Ethereum - Denotation

← assignment

  • an arbitrary element (The value that the program accesses during

execution.) ⇓ big-step evaluation small-step evaluation Οƒ state (address and account state mapping) Ξ“ Transaction flow <BC, Οƒ> Ethereum state as a pair <Blockchain, state> But, do not model miner rewards. (for simplicity)

slide-78
SLIDE 78

Appendix - Towards a better design

  • Operational Semantics of Ethereum

οƒΌOnly one β€œelected leader” executes the π‘„π‘ π‘π‘žπ‘π‘‘π‘“ rule at time.

slide-79
SLIDE 79

Appendix - Towards a better design

  • Operational Semantics of Ethereum

οƒΌOther miners use the π΅π‘‘π‘‘π‘“π‘žπ‘’ rule to β€œrepeat” the transitions after the leader broadcasts block B (Timestamp-dependence)

slide-80
SLIDE 80

Appendix - Towards a better design

  • Operational Semantics of Ethereum

οƒΌsome inevitable order among π‘ˆπ‘— (Transaction-ordering dependence)

slide-81
SLIDE 81

Appendix - Towards a better design

  • Transaction Execution – Denotation (Cont’d)
  • A transaction can activate the code execution of a contract.
  • execution can access to three types of space in which to store data
  • s : LIFO Stack
  • l : auxiliary memory (expandable array, input, output)
  • 𝑑𝑒𝑠 : long-term storage, part of Οƒ[id]
  • π‘žπ‘‘ : Program counter
  • 𝑁 : the contract code array
slide-82
SLIDE 82

Appendix - Towards a better design

  • Transaction Execution – Denotation
  • 𝐡 : Call stack of activation records
  • πœ— : empty call stack, < πœ— >𝑓𝑦𝑑 : exception thrown
  • 𝜈 =<𝐡, 𝜏>: Virtual machine’s execution state

EVM Code on Blockchain

Program Counter

Gas Stack 256 bits * 1024 Memory linear memory Storage key-value store (256 – 256 bits)

Persistent Volatile 𝑑 π‘š 𝑑𝑒𝑠 π‘žπ‘‘ 𝑁

slide-83
SLIDE 83

Appendix - Towards a better design

  • Transaction Execution
  • 𝑗𝑒 : the identifier of the to-be-invoked contract
  • 𝑀 ∢ the value to be deposited to the contract
  • π‘š : an data array capturing the values of input parameters
  • Transaction =<𝑗𝑒, 𝑀, π‘š>
  • features
  • Atomicity
  • Consistency
slide-84
SLIDE 84

Appendix - Towards a better design

  • Transaction Execution
  • πΉπ‘’β„Žπ‘“π‘ π‘€π‘—π‘’π‘“
  • 𝑑𝑒 : start address
  • 𝑑𝑨 : size
  • 𝑀 ∈ π‘€π‘π‘šπ‘£π‘“π‘‘

Example

𝜈 πœˆβ€² per 𝑁[𝑄𝐷]

slide-85
SLIDE 85

References

  • http://www.ethdocs.org/
  • https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-krupp.pdf
  • https://www.usenix.org/sites/default/files/conference/protected-files/security18_slides_krupp.pdf
  • https://solidity.readthedocs.io/en/latest/
  • https://takenobu-hs.github.io/downloads/ethereum_evm_illustrated.pdf
  • https://consensys.github.io/smart-contract-best-practices/recommendations/
  • https://hackernoon.com/smart-contract-security-part-1-reentrancy-attacks-ddb3b2429302
  • https://www.lazenca.net/pages/viewpage.action?pageId=6324534
  • https://en.wikipedia.org/wiki/Symbolic_execution#Path_explosion
  • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/try...catch
  • https://solidity.readthedocs.io/en/v0.5.7/control-structures.html#error-handling-assert-require-revert-and-exceptions
  • https://solidity.readthedocs.io/en/v0.5.7/units-and-global-variables.html#error-handling
  • https://users.encs.concordia.ca/~clark/papers/2017_cacm.pdf
  • http://sigpl.or.kr/school/2018s/slides/0820-02-JonghyupLee.pdf