Smart Contract Auditing: Code4rena Bug Bounty Insights

[00:00:01]hi guys so today I would like to discuss um about a specific paper that have been released really recently I actually discovered this uh this academic paper regarding smart contract vulnerability um with this tweet from byte o32 and it's clearly it's it's not a an understatement it's clearly the most Alpha research that we we have on the the last year typically so basically in this paper The Examiner examine sorry uh 516 smart contract bugs and exploit and take two taken from basically code for for arena and and some other stuff so basically a huge history of smart contract vulnerability they classify all the bugs all the findings everything they use multiple tools they put everything into a dedicated repository that is right there so demystifying a credible bug in smart contracts so they basically do all this job to updn get a bunch of which vulnerability can be applied to Which smart contract type and so on and they applied all this Research into some concrete wizard because they have done some burgundy and contest on code for control for arena and they found multiple vulnerability and get like 100k of bug Bunty so really impressive especially I'm really impressed about all the aggregation and classification of the data that is for me really the real blue value of this paper so that's why I was looking to speak about that let you know my my toe my thoughts about this paper doing a quick like paper review it will be kind of the first time I'm doing that on the channel but I think it's definitely worth it and especially with this paper so uh all the link as usual are on this description below so it's this paper this repository you have the data set which is really important you have of course the paper the PDF that is right there you have the results that contain all the bug classification into a CSV and the same for the description of each context on the contact.csv so that's really nice if you want to use that for some analysis and so on you have all the contracts so I already opened there is a bunch of contracts right there so that's really amazing you have really a bunch of stuff you can explore and take a look of this context that's the total price that's the the judge reroute sorry and so on you have all the configuration and that's really amazing for that you will see that since I have used multiple security tool to see and detect if the bug was fun or not they basically provides you like configuration fine for slitter for Foundry and Kevin for sir int and so on so they basically package and you also have a bunch of configuration files and steps that you can reuse for your own tools or even for the for the next contest so that's really amazing for that clearly so you have everything and uh and also you have all the reports so you have a huge database of all the report as a markdown but again which vulnerability uh what have been found and so on um and all the findings the people also that fund the different bugs and so on even some piece of code so again really documented uh paper uh really interesting I mean so let's take a look at the paper itself so the I will not of course go through and read everything my goal is more to highlight the most interesting stuff typically um there is some really interesting tabs and graph so what you can already see clearly is um so the different category of stuff and more specifically you can see the allocated um after all those Audits and on merch they secure so you can see that it's definitely worth it for a really important project to uh to do this kind of stuff of burgundy and contest uh like like what they are doing just by paying around 7 million they are basically secure more than almost 3 billion in assets so it's pretty amazing uh we can see that in terms of uh attendees and Auditors um it's it's pretty good uh and it's definitely not something you will be able to have uh in general so that's also why I really invite uh when um for example advancing Labs we are not doing um a smart contract audits or only for friends and so on but not uh official stuff because we don't want to to allocate too much them I mean we don't want to do this kind of pure services so the main reason I mean there is plenty of reason but to to make a chart it's not a business I'm really looking forward I'm we are more into research and development of security tool at least to for example detect this kind of venality so that's also why it's really interesting for for us but we are not that much into pure services like that what I want to mention is that having 300 people looking at your code is definitely not something that you will have by paying an audit so always nice if you are a project and you want to get what it did uh definitely um try to have somebody or like a an independent researcher or maybe someone locally in your team that is trying to find all the law on him fruit and then you can go into a context um sorry a contest like this one um people will take a look at your code find vulnerabilities you fix them and then you can go go to a well-known corporate audits well through audit company that will provide you basically feedbacks and stuff like that regarding um like a real audit basically and I can just say some name for for you to know there is of course trail of beat Sigma Prime consensus diligence and and a bunch of other one that are basically well known in the in the ecosystem so I really invite you to of course always have something like that of course if there is open Zeppelin as well whatever I mean plenty plenty of them um so really important really interesting uh and definitely uh worth it regarding the attacks and bugs you can see a bunch of stuff for getting yield taxes uh a bunch of penises as well so uh again really really good uh so this one are real world exploits uh and not uh what you can see that actually the the biggest loss are for stable coins in in the and at the opposite if you take a look stable currents is not the one that was actually uh audited the most I think only six audits compared to the other one so it clearly means passing in my opinion stablecon should maybe do more audits especially on that so I will let you take a look at that something really interesting right there is the classification of books that could be machine auditable meaning that could be found by other static analyzer or further and this kind of tool formal verification as well and symbolic execution and so on so you have a bunch of classification again for you really interesting I did not mention but you have the detail of all the the vulnerability and so on inside uh inside inside the pepper right there you have the supplementary material stuff and inside you have a bunch of additional information like a description of all the machine or detail bugs and so on so again I will let you take a look at that again they give a try to multiple tools or The Leverage on some paper that was already existing you can take a look at that you also have some really good naming of course uh regarding the the tools that could be used for fuzzing again I'm I'm always suggesting uh Echidna um uh Foundry even if it's not part of the list and uh are they that is basically the closed Source further from consensus delicious then you have static analysis my go-to will be slitter um then you have format verification so a lot of people are are using I mean there is a new tool that just emerged recently uh that that seems to be really good I mean I don't have the name right now in head but whatever so um yeah you have plenty of tool for format verification but again it's not the stuff I always suggest because it's to get good format verification you need to write good properties and and rules and that's not something really easy to to do at least at the beginning and for symmetic execution I always suggest metrade Monte car as well that is for me to do good so that's that's really good um some finding uh different Community even invest and protect their product so that's what we saw with this specific tab cleansing indexes a lot of a lot of stuff and at the end it's not them that are losing the most um when they got exploited in the wild so that's that's really good regarding the breakdown of the bugs most of the bugs are machine uneditable so that's really important that's really interesting and that's also why auditing of smart contracts related smart contracts are becoming more and more popular and fit really well with the concept of Burundi and contest it's because you have a lot of logic bugs and and those logic bugs are really complicated or impossible to find with automated tool basically so you you can see like 80 percent of them you have also some also graph but we don't really careful no finding existing techniques relies on simple in general Oracle and and coded ones that are specific to the project and it's complicated to find logic or functional work that's the other name so really good large portion 80 percent that's perfect uh majority of exploitable bug are difficult to find of course the main reason for that is because usually when you are editing a classical software uh for example you are doing a lot of rest go audit like blockchain node we can find bugs that are exploitable that could lead to the nail of service or this kind of stuff and if you have logic bugs most of the time it will just say that okay the specification is not under properly and we reject something that is maybe valid you can see let's think of adult no neck TCP or HTTP or whatever protocol for example if you send something bad it will just reject and that's all it will not impact that much and smart contract you have all the economics behind the smart contracts and all this stuff are really specific to the smart contract Behavior to the state of the chain uh event to the state of other contract that are related to the smart contract may be dependent to Oracle value and so on and so on so you have a lot more external constraints to those smart contracts that could really impact it so that's also why it's really complicated to have a tools that basically handle and um are able to um simulate maybe some weird Behavior like that breakdown of the different type of mob so what we can see so far real world exploit really interesting many price Oracle manipulation privilege escalation specific atomicity okay so price or I can manipulation must have the time and uh okay that's that's interesting so it seems that when you take a look at the code for arena bugs Fund price Oracle manipulation is not something that is fun most of the time but it's clearly something that is expected the most and right there what is fun most of the time is error news in accounting um so so it's something that seems to be a bit more easy to find I mean of course but clearly not that uh as maybe as easy to exploit or maybe not as profitable to export so that's also maybe maybe why and what we can see right there it's more difficult to find price Oracle manipulation that is it for the other one okay so okay I don't really know how to to read that table actually I'm not really sure for me I'm reading that like um the number of auditor is it will be able to find it or hmm I mean I will let you take a look at that I'm not sure how to read that properly actually so yeah yeah I'm not sure uh seven category uh machine um so I did not mention but machine uh sorry bugs uh okay uh what can we say other than that we don't really care for that I will let you take a look more in depth of that and so on so uh as you can see they basically take a look at everything they identify also some other categories guided auditing results uh okay so this part is really interesting so that's basically the Apple all the job of analyzing everything listing all the bugs the type of bugs during the classification and out of that they learn a lot of stuff that are really interesting uh first of all they decided to okay let's give it a try with all knowledge maybe what we know right could help like redirect uh which kind of bird maybe to look for or at least optimize and as you can see that's what they have done so they start doing Audits and um I suppose they mainly focus on the the bugs that was most uh more difficult to find so they try to search for Price Oracle manipulation inside um smart contracts that already have burgundies so really interesting they found two and then they may be focus on the kind of bugs that are most easy to find like error news accounting since it's the one that is the most common maybe they definitely focus on on this one um so they participate to the to the staff abstract model so they also create dedicated tools uh for that maybe they so they mentioned slitter they maybe create yeah they create static analyzer tools um they can have a specific function using slitter so they create additional uh detectors in slitter really nice leveraging on existing tools and the existing tool and shine and then they continue to do that uh different categories and stuff and they find some bugs and they find for they they got like 100 000 USD along all the different projects they they have used um so that's that's really good uh we'll also focus on six type of measurement machine editable bugs so it's in what's what they have done is yeah we focus first on Price Right manipulation and privilege escalation okay really good the two most popular Works according to our studio and friend two and four of them so if you remember this specific tab right there um so the bug that was the most fun in the wild was price rack manipulation and privilege escalation so what that's also mean is that's the kind of guys that was missed on the cut for arena contest and that was still there in the code and that was fine later by attackers so that's that's good so they really focus on what other people are not focusing it's also a good way to um to optimize the amount of money you will get for this kind of contest because less if less people find the bugs you will get a bigger reward especially if it's something critical like privilege escalation or or pom um okay really good so that's that's pretty much all um that's the the old paper it's um again congrats to the to the author and so on and also I think converts to cut one arena for that uh I already discussed with them and I'm clearly a big fan and I'm really enjoying and pushing old project to at some point um go talk to them and maybe do a context for one week or two it's clearly something valuable to be an as your risk as a project is uh I would say close to zero uh if you have both they will find they will potentially find it it will cost you money but that's okay and if there is nothing uh you're gonna pay almost nothing so I think it's clearly a good it's so it's typically this kind of business the business is in the web series security that is a clear win-win solution so uh really really it's it's really good so again I'm putting all the links uh on the description uh please let me know uh what you will like to see uh on the next one and uh clearly I really invite you to take a look at that also use a bunch of those security tools that they have used it's clearly the uh some of the best one especially slither.io Montica I actually don't know for the other one so I will I will take a look at at them but uh yeah clearly you have a bunch of stuff to learn um out of that and uh yeah maybe it's uh it's maybe also a good move for you to do like them and focus on um price or recall manipulation and privilege resolution if you are starting to do some um contest so see you next time let me know what you would like to see and yeah enjoy