Live data from Hacker News

Reviewing Ethereum Smart Contracts

blog.gdssecurity.com

21–30 of 32 posts

Re: Reviewing Ethereum Smart Contracts

#21
post #14

Earlier quoted context omitted.

The EVM itself is fucked, not just Solidity. It has poorly defined semantics and has a number of strange behaviors that you don't want in high integrity systems.

For example?

I would argue that attacks like this https://blog.golemproject.net/how-to-find-10m-by-just-readin... are only possible due to the lack of attention paid to safety in the design of EVM. You can compensate for it by putting more smarts into Solidity and other compilers but the basic fact is that the VM doesn't do much to prevent it. Other modern (and even non-modern) VMs take steps to prevent this without reducing expressiveness or speed at all.

At a fundamental level, getting 0s when reading missing or out-of-bounds values is an incredible red flag for security-focused design. Incidentally I can't even find a concrete source that says how calldataload behaves when an index is out of bounds. It's not mentioned anywhere in the documentation I've found (on the ethereum website or elsewhere).

Re: Reviewing Ethereum Smart Contracts

#22
post #14

Earlier quoted context omitted.

The EVM itself is fucked, not just Solidity. It has poorly defined semantics and has a number of strange behaviors that you don't want in high integrity systems.

For example?

If a function was not designed to be reentrant, then merely sending money to a malicious third-party contract can break the function's intended preconditions and result in a vulnerability. This is exactly what happened with the DAO exploit.

http://hackingdistributed.com/2016/06/16/scanning-live-ether...

Re: Reviewing Ethereum Smart Contracts

#23

It remains a complete embarrassment that Ethereum is based on a home-grown trainwreck of a programming language instead of one of the existing well-supported, battle-tested verifiable programming languages out there. Honestly, they could have used C and been better off because of the amount of C verification tools out there - Solidity hardly seems safer than C and its compiler has a history of potentially catastrophi…

int_19h has previously posted a nice overview of some of Solidity's flaws:

https://news.ycombinator.com/item?id=14810008

Such issues make the language extremely error-prone.

A possible remedy was also suggested:

https://news.ycombinator.com/item?id=14809743

Prolog sounds like a great tool for encoding rules, and there has already been some research for encoding legal texts in Prolog.

Re: Reviewing Ethereum Smart Contracts

#24
post #19

Earlier quoted context omitted.

If you are ignoring cache misses, and using a particular CPU architecture instead of whatever is actually running, then you're back to using gas. You still have a fixed list of costs for different operations, it's just a different list. But CPU cycles aren't actually a sufficient cost model, since you also have to pay for storage.

The original argument (not yours, to be fair) was that EVM/solidity + an optimizer are necessary because contracts are billed for gas. I was attempting to illustrate that you can build a platform around a more representative billing system (you can pick one!) such that existing, world-class languages can be used instead. This pays security dividends and reduces the cost of your system (for everyone, not just you). Wh…

Sure, but I'm not aware of any language with an optimizer that minimizes permanent storage (for example).

The gas model has been forced to be a close representation of actual costs, because last year it wasn't close enough, and someone took advantage of that to launch denial of service attacks.

Incidentally, last year someone wrote an Idris backend compiling to EVM for their doctoral thesis. They concluded that it had some benefits but not as much as they expected. [1]

There's an effort in progress to migrate from the existing EVM to a modified webassembly [2], which would allow usage of existing languages, and potentially improve performance significantly. It's still experimental and may or may not work out, but seems to be making good progress. [3]

With the existing EVM there are new languages in development that may improve matters, including Viper [4] (by Vitalik) and Bamboo [5] (by someone the Ethereum Foundation employs to work on formal proofs).

[1] https://publications.lib.chalmers.se/records/fulltext/234939...

[2] https://github.com/ewasm/evm2wasm

[3] https://blog.ethereum.org/2017/08/23/roundup-5/

[4] https://github.com/ethereum/viper

[5] https://github.com/pirapira/bamboo

Re: Reviewing Ethereum Smart Contracts

#25
post #9

Earlier quoted context omitted.

> Note that some of these bugs are in an optimizer, something a security-focused package handling money shouldn't even need Contract callers pay gas fees to execute the contract so inefficient contracts literally waste transaction fees - if anything optimizers are even more important here. > Any claims that performance justifies the use of a home-grown language are also absurd: High-performance trading firms like Jan…

You're accepting the assumption/abstraction made by Ethereum here, where "gas" is equivalent to performance, even though gas is an arbitrary measurement. You could easily build your own gas-focused optimizer for a toolchain like llvm or for a compiler like ocaml's. Ethereum could bill contracts based on the actual cycle count they take to execute on the CPU, or some other metric. Then you wouldn't need to use a speci…

> If the 'value' of executing contracts in $/gas exceeds the cost of renting AWS/EC2 nodes you're basically created a market for mining arbitrage, and perverse incentives where those miners want to push the prices in one direction.

I think you misunderstand what gas is for. The cost (in terms of transaction fees) to execute something on the EVM is already many many orders of magnitude higher than what it would cost for a single person to run the computation by renting some CPU time from AWS.

Think about it in the case of Bitcoin. Simplifying a bit, most Bitcoin transactions just consist of subtracting a number from one account balance and adding it to another account balance. That's an incredibly cheap operation by any metric, yet Bitcoin burns through a million dollars of electricity every day.

The reason it costs so much to run code on the EVM is, most of the "cost" goes toward ensuring consensus (or, from the contracting parties' point of view, immutability). Transaction costs and block rewards currently go to miners (in the current PoW world anyway, in PoS this explanation will be slightly different), and miners don't spend most of their CPU cycles running the computation, they spend most of their CPU cycles trying out a hash function (Keccak-256) as directed by ethereum's PoW algorithm (ethhash), and if they're lucky with the values they hash they mine the block. This CPU time only serves to reach consensus, and does not to do any useful work for "just running" the EVM code itself.

Another thing that proves that gas does not really correspond to CPU cost directly is that they recently extended it with new primitives (specifically, "elliptic curve multiplication, addition and pairing") as part of a research effort collaborating with zcash (which uses those primtives in their zero-knowledge-proof protocol for allowing private transactions). Of course the EVM could do it before this change (since it's Turing-complete), so if gas = cpu time, why bother adding this primitive?

As to what purpose gas serves, the best source is probably http://vitalik.ca/general/2017/09/14/prehistory.html, but as I understand it it's to prevent DoS attacks and to limit the size of the blockchain (since every contract call ever made, its source code, and hence every EVM instruction executed, is part of the immutable ledger).

> Event-oriented programming is old hat in every modern programming language. C/C++ have plenty of frameworks out there you can use to get at it, so do other languages. In some environments it's the de-facto way to write code.

Sure, but it would have to be a core part of the language, it can't be a framework or library. For instance in this contract https://theethereum.wiki/w/index.php/ERC20_Token_Standard#Sa... there's a transfer "function" that addresses call to transfer tokens around. It doesn't run in the context of a "main" function (in the C sense), it just runs and updates some state. So there's some different semantics here (not big differences, just enough that I would call it necessarily a different language). Similarly an event-oriented programming framework for C would probably include a runtime scheduler (probably written in C or assembly), but the EVM and the block-mining framework is the scheduler in EVM's case, it makes no sense to have a runtime scheduler run as "bytecode" or "CPU instructions".

Re: Reviewing Ethereum Smart Contracts

#26
post #11

Earlier quoted context omitted.

Whoa there! Sure Ethereum has it's problems, but going as far as "the people running Ethereum have incredibly bad taste and make poor decisions", displays a huge amount of ignorance towards some incredible engineers who have built a fantastic (and very successful) platform. Ethereum is far more than just the contract language -- it's the distributed consensus system, the merkle-tree backed blockchain, the p2p network…

I'm not willing to "give them a break" if they ignored decades of existing academic research and production software to roll their own low-quality packages that actively cost users money through bugs and footguns. Ethereum is not breaking new ground all over the place to the extent that would justify overlooking quality issues, even if it's the first to do particular things. I'm sure the Ethereum ecosystem as a whole…

Find me a system that does not "actively cost users money through bugs and footguns", and I'll find you something that isn't used.

> Complex and Sophisticated is not a good thing in mission-critical software.

The complexity of Ethereum comes from the domain. You can hold on to the platitudes.

> Complex and Sophisticated is what you write when tackling an incredibly difficult problem or when you're trying to get a promotion.

If you don't believe that cryptocurrencies are an "incredibly difficult problem", then, again, you're showing your ignorance. As someone who worked on distributed consensus systems (Paxos) for nearly a decade, I would recommend you pick up a textbook before passing judgement on the nature of this problem.

> You seem to be confusing the (no personal opinion on this statement) "fantastic and successful" nature of the Ethereum platform with its quality.

Thanks, however, I'm quite familiar with the orthogonal nature of success and quality -- it also turns out that just because it's successful doesn't automatically make it low quality.

And really... chill out.

Re: Reviewing Ethereum Smart Contracts

#27
post #2

I saw this on Twitter today: Cyber security is a nightmare. Crypto asset security is a 10X nightmare. Smart contract security is a 100X nightmare. https://twitter.com/lopp/status/911020364829884416

But if pioneers do not grind their teeth on real world implementation, application, and hardening how do you expect those scales to change? Was it better when even US mil branches roamed the public internet and people dialed in with naive attacks?

I applaud these developers like those who died exploring countries unknown, minus the raping and pillaging and colonizing (not ironic; I just know people on HN will call me out if not clear preemptively).

Re: Reviewing Ethereum Smart Contracts

#28
post #13
post #6

Imagine if Windows 95 stored your payment data and was bridge-connected to the internet. This will give you an idea of how I look at these smart contracts. Is there any reason to think of it another way?

Yes: smart contracts are extremely short programs, usually doing very simple things. A thousand lines is a fairly large contract. It's feasible to spend a lot of time refactoring to make them as simple and clear as possible, to unit test extensively, and then pay several expert parties to review them in detail. We're not quite at the point of being able to do formal proofs of their properties, but that's on the way,…

Smart contracts are not that short, and if you look at entries for the Unhardended Solidty Code contest you'll discover just how easy it is to implement a vulnerability due to the nuances of Solidity and the runtime.

The virtual machine is also not even remotely proven yet.

There is a lot of risk.

Re: Reviewing Ethereum Smart Contracts

#29
post #13

Earlier quoted context omitted.

Yes: smart contracts are extremely short programs, usually doing very simple things. A thousand lines is a fairly large contract. It's feasible to spend a lot of time refactoring to make them as simple and clear as possible, to unit test extensively, and then pay several expert parties to review them in detail. We're not quite at the point of being able to do formal proofs of their properties, but that's on the way,…

Smart contracts are not that short, and if you look at entries for the Unhardended Solidty Code contest you'll discover just how easy it is to implement a vulnerability due to the nuances of Solidity and the runtime. The virtual machine is also not even remotely proven yet. There is a lot of risk.

I write and audit Ethereum smart contracts for a living. Most of the projects I work on aren't much bigger than a thousand lines, and many are less. Some especially large projects are several thousand lines, still many orders of magnitude smaller than Win95.

Re: Reviewing Ethereum Smart Contracts

#30
post #26

Earlier quoted context omitted.

I'm not willing to "give them a break" if they ignored decades of existing academic research and production software to roll their own low-quality packages that actively cost users money through bugs and footguns. Ethereum is not breaking new ground all over the place to the extent that would justify overlooking quality issues, even if it's the first to do particular things. I'm sure the Ethereum ecosystem as a whole…

Find me a system that does not "actively cost users money through bugs and footguns", and I'll find you something that isn't used. > Complex and Sophisticated is not a good thing in mission-critical software. The complexity of Ethereum comes from the domain. You can hold on to the platitudes. > Complex and Sophisticated is what you write when tackling an incredibly difficult problem or when you're trying to get a pro…

So we shall believe that new dubious language with its runtime and each-time custom scripts magically turns high-quality, because the environment is complex and someone spent time and read a book in that area? Despite the fact that many users suffered security bugs in carefully managed world-grade quality products for decades and it still happens? Okay.

>chill out

and give me your money, right. Yet another soapy bubble.

Post reply on HN