ERC20 Misbehaviors – Sergii Kravchenko

today we're gonna talk about your c20 misbehaviors so how there's you know almost every project in the ecosystem use your si twenties and a lot of issues it might happen with that so we're gonna try avoid that with this presentation so I'm sorry I work at consensus diligence as a security auditor so let's let's dive into your C twenty I hope everybody knows what that is but let's just remind it that it's like the most common here C it's the most common talking standard with the like minimalistic functionality you have only only what you need transfers approved to transfer from you like check balances and like the the most useful things for you so but different extensions that that people are making like your c 223 or a or c 777 that has callbacks to receiver sender so just random contracts and different other options how you can to callbacks also like lots of security tokens the most popular lately was like your C 1400 they allow you to do like partitions lock in part of the fonts for west rain make a YC white listing anything so it's like huge frameworks with many modules and bunch of custom implementations with meaning like mini-me with with history of balances you can easily clone the token and like create a new smart contract with the same balances in at some point in history some tokens with a proven call functionality so we can approve and call some function that makes transfer from in in the same transaction some tokens are just controlled by essentially controlled by some Authority it can be stopped or transferred or anything so like a lot of and custom implementations might be here if I dive into intercom on issues like this issues are mostly relevant for for projects that are working with with different different kind of random tokens like exchanges investment funds we try to invest in different tokens sometimes they whitelisted sometimes they just do anything if you're working with like your own simple 80/20 that might not be that dangerous for you so like the most tricky an interesting attack that I see in energy 23 entrance II just to remind what your entrance is like consolidate a bit about it but this is like example 4 for tokens so you see three functions transfer from make trade and talk into sense allocated in different contracts so exact flow is simple it's pretty simple this is like exchange example so Center makes a trade by calling make trade function of the exchange inside of it token transfer is happening so inside of this token transfer if this is for example RC 777 there is a callback function to to the sender after that sender can make one more trade by Colin make trade function of the exchange so basically you can make one more trade before first trade is finished and you can do it with an ultra prize for example if it's automated pricing or do a lot of things that are not intended to be there also different types of reentrant see for tokens for example depending on who is who can do this this arrangement attacks so this is either the center of the token or receiver or some search party contract like like kyc provider or something like that and the second criteria is like when it's can be used it can be used either before or after valid transfer which is also important because like if you're making token transfer as the as the last line of your function and it's already made then the rent in C wouldn't really do anything it's like almost function is almost over interesting example of this this kind of attack was with Yuna swab so this is like very famous exchange that maybe you all probably know it's it's totally automated it basically the previous example was showing a unit swap attack but with different function naming but the IDS is pretty much the same so this is this kind of exchange stores equally Eastern tokens in his smart contracts and it was interesting it was already live on the main net so it's kind of hard to to migrate to new version so this bug is still happening with your see that allows some kind of rare entrances basically RC 777 is not supported by units not for that reason so because of they don't have entrance fee protection you can do one more trade inside previous trade with the old price basically having better and better price over over the Renton C then you can do to make it trade back and just earn free money out of it so what you do is rent rinsing in in tokens as in any other place you just use open settings for entrance Agard which is pretty good right now you can use non entrance modifier and after laters updates it become more cheaper because recently it was like ten ten thousand gasps four four four two storage tests or functions now it's got cheaper formulas pretty complex but it it is cheaper but also you make sure that you only use this non reentrant modifier where it's wherever entrance is not intended because with some multi-sig wallets or voting contracts you can actually really want to have their entrance e and and also make sure that rent non rented modifier is it's called in every function that is relevant not only in functions that inside of which you can do rear entrance e because you can from the function you can do entrance e and call another function which you might consider it safe but it's not because it also might change state and make some unintended behavior lead to random random results even if you even if you know that that even you make sure that your entrance is not an issue for some reason either you had rear entrance II protection or something you still need to understand that when you do the token transfer it's not enough to just have enough balance and and permissions like approvals to do the transfer transfer can still fail for many many different reasons for example your user or even your exchange or anything can be blacklisted or some other key we see okay we see reason why you cannot use this token for example USD C can blacklist anybody and you need to be prepared for that some tokens can be just locked for Westing or for some other reasons sometimes tokens can be really gasps costly and if you if you make multiple transfers in the same functions it sometimes might also run out of gas even if you limit it to like few few few things it might still be pretty pretty expensive and you know lots of tokens are pretty much upgradeable maybe not tokens but as you see in this example controller is like separate contract that approves some transfers and it's usually upgradable by the owner so what do you need to do to to keep safer to make it safer you can isolate all of your transfers to not to do for loops about budge trans best transfers so if you have transfers in a for loop one of it might fail and it can block all of your pipeline and just maybe block the contract freeze funds so basically just use better pull pattern for all the each possible token withdrawal wherever wherever you can do it one more interesting issue is balance overflow so you would usually expect that total supply is not overflowing and and if you if that happens if balance is more than you into 256 that usually means that token is either malicious or broken or both and this tokens price would would most likely be worthless it would be zero but still if you're working with lots of different tokens for example I can in this example you are signing Awards and usually have a four loop - you're not making transfers so you already took care about my previous recommendation you do not do transfer but you store balances so people can withdraw them but sometimes people still do it in a batch just like that and if one of the token is broken you this this line of code will just revert because safe mass add would revert because of the overflow and because of that you might just freeze your pipeline and like all these tokens that should be assigned they are locked forever and might be lost so this is not a good behavior and possibly remediations would be either just ignore safe mass and allow overflows so this is not a traditional advice because we usually we usually advise you to use safe mass and just not allow any overflows but sometimes it's it's easy easiest choice how to how to fix it or you can sometimes store balances in to you intervals to allow like much much bigger rellis but it's just like a huge huge huge cost of doing that also this was an interesting issue in the past that sometimes some tokens are just not ear c20 compliant so the the original implementation should return like every transfer transfer from should return true but there are some tokens that just doesn't do it as you can see the weight lost function is a brown implementation of token transfer for example balance token is like that and like hundreds of tokens that also have this implementations and the thing is that people how people use it like usage function that you see here how people use it it's it will just revert it wasn't a problem initially that's why we have so many tokens because B for one of the hartford's it was fine it was always returning true and nobody noticed it but after one of the heart for works like some some selenium changed and now you basically always have false so yeah make sure that if you if you want to work with this kind of tokens you can check if it's returning value or not and work work this out if not you can just also ignore it but it should it be irreverent if you're deploying your own token so sometimes people want to try to do your see 777 tokens and make something more complex but you need to also understand that some of the major projects might not just support it because they have bugs that do not do not approve any kind of rear entrance II also consider making R entrance a protection inside tokens so some projects are doing that if they're having to complex code so they are just having rarity protection inside it doesn't really matter if it's if it's if other projects that I used in it have this protection or not also make sure that gasket is optimized because in in many different projects people assume that transfers are pretty cheap and they do it in batches still and if you want these tokens to be traded like this should be a major point of your attention and again make sure it complies to RC 20 yeah if you have any any any kind of questions contact us so yeah question time one two three cool thank you very much [Applause] [Music] you