Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smart Contract Security Field Guide

scsfg.io

Post reply on HN
Print view View original

21–30 of 156 posts

Re: Smart Contract Security Field Guide

#21

Post by greiskul »

pcthrowaway wrote: post #9
flooow wrote: post #6

Every time I hear about another massive hack on Ethereum, I feel a little bit sad that I didn't specialize in software security. For many years there was huge amounts of free cash just sitting on a table waiting to be taken, a victimless crime (VCs and cryptobros are not victims, everyone is playing the same game). I expect the low-hanging fruit has gone now. And setting up spearfishing attacks to scam teenagers out…

As a dark-hat in the space you'd have a pretty good chance of being caught by chainalysis eventually. Meanwhile there are still hundreds of millions of dollars of bounties available for white-hats who responsibly disclose. The dark-hat hackers who aren't held responsible are likely in either Russia or North Korea

It's amazing how quickly code-is-law becomes regular law is law when the code allows all your money to be stolen. And that is the nail in the coffin of this ideology, proponents of blockchain claim one day your house deed will be on the blockchain. What happens when people hack your house away from you then?

Re: Smart Contract Security Field Guide

#22

Post by rattlesnakedave »

greiskul wrote: post #21
pcthrowaway wrote: post #9

Earlier quoted context omitted.

As a dark-hat in the space you'd have a pretty good chance of being caught by chainalysis eventually. Meanwhile there are still hundreds of millions of dollars of bounties available for white-hats who responsibly disclose. The dark-hat hackers who aren't held responsible are likely in either Russia or North Korea

It's amazing how quickly code-is-law becomes regular law is law when the code allows all your money to be stolen. And that is the nail in the coffin of this ideology, proponents of blockchain claim one day your house deed will be on the blockchain. What happens when people hack your house away from you then?

Code is law. The issuer of tokens backing rwas should be able to figure this out and reissue.

Re: Smart Contract Security Field Guide

#23

Post by WinstonSmith84 »

jjordan wrote: post #16
sunshine-o wrote: post #13

Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…

There is a thriving community of security researchers and engineers in the smart contract auditing space. Services like code4rena ( https://code4rena.com/ ) and sherlock ( https://www.sherlock.xyz/ ) make audits a public and competitive process with leaderboards that track the best of the best. Naturally those that rise to the top of these leaderboards tend to end up offering boutique auditing services due to project…

Yes you're right, there are very talented companies, but that's actually what the OP has been saying... These companies exist because of the language. No language is perfect but Solidity is very imperfect to say the least

These challenges are very interesting https://ethernaut.openzeppelin.com/. The thing is, almost none of these hacks could be possible, if Solidity would be better

Re: Smart Contract Security Field Guide

#24

Post by mypastself »

dafelst wrote: post #19
iramiller wrote: post #17

Earlier quoted context omitted.

Doing crime on a system with a perfect immutable record doesn’t seem like a smart play to me. As noted above the firms like chainalysis will continue to uncover and attribute all of the nodes in the graph. If you are taking 100s of thousands or more through fraud the incentives are aligned to see your crimes prosecuted.

I think the main takeaway here is that in many cases wrt crypto, it is highly ambiguous on whether the actions you take are criminal or not.

Agreed, especially given that frontrunning and similar techniques are almost inextricable from the technology’s default behavior.

However, actors other than law enforcement can also perform chain analysis, and you’d probably prefer to stay anonymous if you engage in such practices…

Re: Smart Contract Security Field Guide

#25

Post by sunshine-o »

jjordan wrote: post #16
sunshine-o wrote: post #13

Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…

There is a thriving community of security researchers and engineers in the smart contract auditing space. Services like code4rena ( https://code4rena.com/ ) and sherlock ( https://www.sherlock.xyz/ ) make audits a public and competitive process with leaderboards that track the best of the best. Naturally those that rise to the top of these leaderboards tend to end up offering boutique auditing services due to project…

Yes but as you see on code4rena the cost of an audit is about $100k.

What is ballpark what a company would pay to have a security audit of their website or network for example. So I would guess Ethereum has become an "Enterprise" technology because of the prohibitive cost of security of its applications?

From what understood originally, blockchain & Ethereum aimed removing those actors like banks who can afford high cost of licenses, compliance & security of complex systems.

Meaning you could write and execute your will without a lawyer and a court system, or write a smart contract to manage a condominium and its treasury with the other landlords (a $100k audit is out of the question for those use cases).

We are hearing less and less about those use cases and talk more and more about "Enterprise Ethereum" (https://ethereum.org/en/enterprise/) as we find out that developing for the platform will be as complex & expensive as for a big corporation.

Re: Smart Contract Security Field Guide

#26

Post by liveoneggs »

iramiller wrote: post #17
dafelst wrote: post #14

Earlier quoted context omitted.

At most you are going to make a few thousand, maybe if you're super lucky and skilled, a few tens of thousands of dollars on bug bounties. Compared to the amount of poorly-secured money that was/is in crypto, it is a pittance. Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black ha…

Doing crime on a system with a perfect immutable record doesn’t seem like a smart play to me. As noted above the firms like chainalysis will continue to uncover and attribute all of the nodes in the graph. If you are taking 100s of thousands or more through fraud the incentives are aligned to see your crimes prosecuted.

is it a crime if the smart contract acts as coded, but not necessarily as intended?

Re: Smart Contract Security Field Guide

#27

Post by duxup »

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract?

What is anyone doing with them that they find really handy?

I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it.

I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in the end. Often it's described as a magic thing that eliminates the use of "intermediaries" and so on. I suppose that is true but you only get to that by going through all the complexity of from making sure someone writes a good contract / getting folks from the outside to review and validate it and so on. I'm not sure that saved a lot in the end.

Much like a most things blockchain I find these ideas (not bad ones) and then the practical usage ... much less than ideal.

Re: Smart Contract Security Field Guide

#28

Post by freemanon »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Well it was the same with the internet itself. It's prone to hacks, bugs, and outage, and yet today we all use it to manage our finances and make payments.

Re: Smart Contract Security Field Guide

#29

Post by Veserv »

jjordan wrote: post #16
sunshine-o wrote: post #13

Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…

There is a thriving community of security researchers and engineers in the smart contract auditing space. Services like code4rena ( https://code4rena.com/ ) and sherlock ( https://www.sherlock.xyz/ ) make audits a public and competitive process with leaderboards that track the best of the best. Naturally those that rise to the top of these leaderboards tend to end up offering boutique auditing services due to project…

But does it work?

Do any of the audits ever come back clean i.e. no detected defects?

Are those audits actually serious and representative of the resources available to a profitable attack? Many smart contracts manage millions, tens of millions, hundreds of millions and up in value. Do they actually do multi-year audits with a team of 5 that come back clean?

Do they seriously believe and publicly state their design processes are better than the best IT systems by Google, Apple, Amazon, NSA, FBI, etc.? Because those organizations can not get clean audits against red teams with multiple people and a few years to work.

That would be a extraordinary claim, do they have the extraordinary evidence to back up that claim? Do they even have any verifiable evidence at all to back up that claim other than more marketing drivel?

If the answer to all of that is not yes, then it all sounds like a house of cards and just more “security” bullshit to me.

Re: Smart Contract Security Field Guide

#30

Post by jjordan »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Arguably the most popular use case is that smart contracts are used to create decentralized exchange services. See: Uniswap.

They are also used extensively in the crypto sub-genre called DeFi, or decentralized finance. One of the most popular implementations is called Aave, which allows one to take loans out (i.e. give the contract Ether as collateral, receive an amount of USD stablecoin in return) on a given set of assets.

Of course every NFT you ever heard of is essentially its own smart contract (specifically one that implements the ERC-721 standard of functions and public variables), though I'm not sure that qualifies as a 'good' use case. ;)

Post reply on HN