Pentesting Ethereum Contracts: Exploring a Honeypot Contract Using Ganache (Devcon5)

[Applause] all right I am the rook I am the lead on ganache that trouble and this here is the eternal blockchain engine or engineer consider in this light so it's shortened and we're going to get in trouble teams yeah so if you have can ask questions we are the people that trouble to ask so you all probably know who truffle is known residents and do what to anyone but if you don't so truffle is a company whose goal is to build tools to get developers from idea to death as comfortably as possible so I think sums up our our goal pretty well so we have three or four but three main open-source tools someone is truffle which is a dev environment testing chamber in NASA pipe pipe line for blockchains drizzle is a front-end library for gaps and then of course ganache which is your one clique blockchain so what is ganache so ganache actually comes in three variants and most people think of ganache as the UI what you guys think like who's here it not who is aware of UI and CLI and core so who hasn't heard of one of those things wait which one core okay anyone else okay sir core core is the part of ganache that does all the heavy lifting and so ganache core is a separate MPM projects that CLI actually this wraps around so if you do like require ganache pork and your project then you will get the provider and a server that seal I give you anything access at the programmatic axis rather today on the sea life so this is what I cannot see why looks like this is the main account screen that starts up you get 10 accounts by default you have a mnemonic don't put that on that please assume so this is trouble contract integration so if you have a trouble project you can add that to your Nashua and you can actually see all of their deployed to your local cosmetic gosh contracts there how many transactions that our auditor every useful and new as a yesterday ganache for King does anyone know what they're not just working is nobody alright that's fine cannot see alive and for close anyone seen that do okay alright you come up and teach good so ganache poor thing is a really hidden feature of cannot it sounds now on you I and the alpha version you guys come down looking over if it breaks my literally posted yesterday so my god might not be too stable but ganache working lets you easily easy maintenance thing without the cost so what that means is inside of ganache UI you can now select maintenance like from Keira as provider or you put your own provider in and it's a ganache well then fork at a specific block number that you specify or latest and so when you start it up ganache you will actually get instantly well a couple seconds these are these are mini Matlock members right here and the dates that they remind and I Got News for them and all of the transactions are here without sinking and additionally when you now run your contracts against your local ganache it actually emulates being on beignet that coverage is a sound good so so risk free no cost so you can deploy your contracts to ring that using other contracts that are employed on maintenance oh sorry to ganache you I like it was on maintenance so it's like fully emulating men yet maintenance so it's like you fork right at this lock number here the four o'clock and all the data that is on magnetic now available to your contracts under what she paid a feature any new transactions will end go on the fork so you're sort of risk free access and if you had sort of to access say some seat or data that was previously on the chain was just requested from your provider questions yeah so we actually just so that counts you something slides back so you actually the way that works is we just lie to the state and we just say each of these has 108 that says just the default and so we do the same thing with 14 as soon as before the very next block number is an empty block that basically just changes the state we just kind of forced it to happen in addition on that note actually we also allow you to sort of pretend to be any account that you want so if you want it to be issued sends actions on behalf of account that you have you being you can be a count 0 if you want bread right doing enterprise are you gonna you can emulate that so you can unlock those accounts if you want to so you can pretend to be the down hacker and hacked it out so to me the theory of development is kind of high risk actually earlier today we burnt some either trying to deploy and we shouldn't have but we did and other issues or your bytecode is public so you can't hide your source code so you know you shouldn't use obscurity by a security by obscurity but in a way we all kind of do normal development but theories a little different all your contracts are public so anyone can run your software in it I think you all know this but meanwhile the hackers are private and anonymous and there's no recourse for if your contract constraint you don't know who that is it is no jurisdiction jurisdiction that can come after those people so if you mess up you or your users lose big it's your recourse so some key concepts are gonna go over this real quick gasps fallback functions and re-entrant see sorry I can actually see that slide to transact on theory you must pay a fee this fee is paid gasps gasps the faithful and Ethan operations on areum likes or the changing data transferring funds math operations looping collect requires some amount deaths generally transaction attempts to use more gas than it is given the transaction fails no state changes birth persisted sonar fallout functions these are functions that can execute operations as long as there were enough gas for t2 it a fallback function must be external and it is the unnamed function in their contract it is called for any contracts address to set ether or a non-existent contract function is called who hasn't heard of public functions I almost won't go through this skip of that and re-entrance e Boehner goalie does anyone know what that is already there cup of you so this is fun so I don't know we spent like an hour trying to come up with this line you try to get it down to one direction cringe but it's the most basic way I can define Regency vulnerabilities for smart contracts is it's when a contract permits unintended re and rotation of any of its methods after pulling an external contract during a single transaction it was pretty dense so I'll say over time where the contract permits unintended Rhian vocation of any of its methods during a single transaction so another way of saying it smart contract your agency allows for multiple applications other contexts and methods during the same transaction usually caused by forwarding excess guests to be malicious to contracts while that funding them without proper redundancy protection so that's that's there's a lot to take in there and we're gonna get into much more of this so a reentrant vulnerability example is anyone does anyone know actually where the vulnerability is and this code [Music] the balances he loved every second there was another Christmas in the Camry contract that's it right here yeah so this line right here is a reaction similar ability and the reason for that is centered up call of value go pass all of these remaining gas that's left for this transaction into the sender and sort of send there is a contract and with a fallback function that is payable then the sender will be able to execute additional transactions after the fallback function is called and so one of those transactions may be to recall withdrawal and I'm the problem with that is that this line will execute I think I have all this data so here wait I'm getting ahead of myself we'll get there fast so before we get started I'm gonna teach you guys how to do this this remember just because you can doesn't mean you should the intent of this workshop is to teach you how to protect your contracts is not to teach you how to exploit others contracts so don't steal all the illegal Unitas people this is for protesting your own contracts and in a real world scenario yeah so don't say truffle talking how to steal okay so I was getting my help myself there I really wanted to stir this so this would be an example of a an attackers contract that they offload in order to be bad so I miss them here is the fallback function and so we saw that in my contract earlier that it was could be reinserted and so I'll show you how that works here so what happens is initially that one of the cases in a contract is to see it with some amount of value and so what does them here's it's depositing let's say wine and ether into the victim the contract was all just couple slides ago into that contract so they now home that anchor as a barrel imbalance in that contract so the attacker then would call the BiPAP which were being called withdrawal and now this would all work wonderfully so this withdrawal within just within all this one has got value but because of this hacker being a little bit clever they implemented this whole hat function and what this function is going to do is after the original contract gets this amount from them from the caller from this concept here it'll get their balance and it will record that and then send that amount back to the contract and at which point the contract will then be able to go into this fallback function and call withdraw again and so what this then does is re-enters and checks the balance but we haven't zeroed out the balance yet in the original context so this balance is still the full one ether and so this is the second time we've been here and so the next line is going to be to call that fall that function again and so we're back into the bad guys contract and what are they going to do they're going to withdrawal again and they can do that as long as they have enough yeah so that's what this little check here is it just checks jobs to make sure that the transaction won't fail so pretty crazy happens in the real world so this is an example of how you would execute this sort of attack using truffle to run your test so the attacker would deploy their contract to main app and execute the attack you disappear contact is all you need to do is run truffle test looks this and so this is its hang with deploy so we're sitting into the wand ether here pointing it there and it's executing the attack that's it that's all it would take all right so what we've covered so far truffle ganache nice working gas and fallback functions re-entrance see the exploit and a little bit about truffle test any questions so far someone has no all right we've all heard of the dow hack and the dow hack was a hack that was based on Regency it was a Regency bull vulnerability in this function right here so they are in this function here in are sending all of the remaining gas to the recipient and that enabled the recipient to call back into this function it was actually much more complicated than this there's several methods that they had to go through and kind of kind of figure in order to get this payout to be called again but this is how they did it I think questions on that I'll leave it up all right well questions anyone have any good they skip a slide so there's a bunch of ways to do reentrant sea protection and your contracting methods so one is this thing called the check effects interaction pattern and so we're first you do a check so you see that their balance is greater than zero for instance and then you perform the effect that an interaction will help so this is you zero out the balance before you send it which is what you were saying earlier and then once you do the effect that you finally run the interaction another way is using Rafi interview types morbid Zeppelin's like we're in chancy guard and this basically is you have a boolean value you can call it blocker or any want which would be true false and so when you come in together the first time this requires the middle class event you would immediately lock it so now if anything happens when you do the things this condition will fail because lock is now true and then when you're done just make sure that you unlock your contract if you jump if there's an error and this lock doesn't unlock then you can effectively lock your contract we're getting you from okay that myself and this is real important who has heard of Edison and had his transfer and why those were out or one of the reasons why anyone know so these were added because of the answers that call sending all of the remaining guests by default and so that was seen as a homeowner ability and that were really clear that that would enable Regency and so what they did as they come up with either son I just transferred which will automatically limit the amount of gas that's passed to 2300 ish its talkative but what that did was effectively make it so that it was too expensive to do anything in a fallback function that could possibly result in reaction see and so now if he used how the sender as that transfer and to send that ether the fallback function would be stuck there wouldn't be able to get back out and into your your contract any which sounds great it sounds like that would fix everything and it did but problem was I just went to slides again Constantinople everyone everyone knows about Constantinople I'm guessing it's it's great so Constantinople had an EIP that actually lowered the minimum gas cost for storage from five thousand to two hundred gas insurance system situation great ish it's not kid so when that would happen if all that functions could now fall back in and perform Regency because the constants really caught this a couple days before externalizes crazy so luckily in the con it it was removed and never made it to Maine that also issue because it actually is active on the net was just and then there's Istanbul so it's sampled increased gas costs actually kind of do the opposite as Constantinople's decreases we're doing and that there are now functions on live contracts that can not that will no longer work so this is actually common faces from contract that would be States before incident is stable for a lot but these three parts are its position in the total I would actually do like 2x loads or 1 X load and because of increased cost and s loads and a couple of other optos this one L fail every single time there's no way for this to pass up its Istanbul so the point being that you cannot rely on gas costs as we protect its Regency so just remember that that's the only thing so always be aware that so the honeypot I'm hot is fun and then run heard of a honeypot and like infra sec yeah so honey pots in InfoSec are actually a little bit different than what we call honeypot aetherium but we're gonna we're gonna keep calling a honeypot because that's just we make things so a honeypot is a way to trick the bad guy it's becoming a vapor and I so there are several types of processes you you can go over here there are three different sort of general types actually they're really well laid out at this link but in general is sort of taxonomy of hot coffee pots are their three main classes that class honeypot said interact with machine some that happened during compilation and some that are actually just due to misleading or missing information on block explore so again for an example like p.m. just a well-defined set of rules and everyone should be sort of or has access to those rules however given the implementation of some contracts they could look sort of non-intuitive and therefore would be able to trick you some some bugs actually exist in the solidity of pilot they're actually usually very well documented but there can be some that have not been discovered yet our sorcerer basil and then for example some things in watching explorers or gently there was a time where we cursed and only showed you meaty characters wide if you were to upload a contract had something outside of that you wouldn't be able to see say that there was a salmon or a trans person that's the general gist and we'll go into some fees this next slide is fun remember you'll hear it so just love the slides up some people came in so make sure you go to these slides at double codes by step compaction so this next one slightly gonna skip over but it's fun and I spend too much time on it so you guys should just check it out just tell me if you liked it we'll go ahead the trace Buster Buster anyway the so far is covered truffle ganache ganache porkiness fallback functions for instance the exploit testing a Dow Constantine elements in Istanbul Regency protection and honey pots questions about any of that yes you remember the the difference is something balanced if the way it fails right if if I recall correctly is I believe it's what what is passed along as your message sender and like sorta like a context that is calling or yeah I think it is just the way that it fails because actually really excellent answer for on Stack Overflow Isis can't remember which one [Music] okay so Sandra will return a boolean yes it works or not good and then transfer will right yeah so I it's kind of like an idea so it's like you can have like lots of different types of honey pots so in info set it would be probably a mousetrap sort of like a honey pot in at the second it is just like like or our way to learn about your attacker so you set up a network that looks open and see what the attacker does that's right that we can learn from you so an InfoSec mousetrap is a way of trying to convince the attacker to come in and see your network and give something up somehow and that way you can catch them and win that way so we're actually so in the theory of them cause a honeypot or a mastermind so a honeypot is the contract that fools somebody an attacker into giving something up usually that's going to be the trick transfer throws in senators box failure all right so work self time we're going to take all of that and we're going to exploit or attempt to exploit ain't no and honeypot on the net and so as an overview what we'll be doing is taking the code that we see young ether scans so that this this person that of one of this contract in this one they uploaded their contract code to ether skin except it wasn't their contract code so even though ethers can't verify this right by code there's some tricks in there that make it actually behave differently than what you see in the code and so we're going to see how if you just wanted to exploit this because you're a bad guy and you wanted to steal the ether stored in the contract it would fail and so we're going to do that we're gonna we're going to run this and we're gonna run out locally and ganache and we're gonna see that it fails and then we're gonna run it locally and ganache with forking enable off and the conference Wi-Fi is a little rough but we're gonna try anyway and yeah it'll be fun so everyone needs to go to workshop will GE to this slide figure on download no js' I just put 10 there it should work on 8 it will likely work on 12 that's not a lot of very important doesn't work wrong well if you want to use you is because you're more comfortable you I think you down try to download browse your alpha I can also try to set up I have all the version for Mac Windows my next phone my laptop and so I can give you links to try to download right from my laptop if we have to or install ganache COI and you can choose the global black here if everyone needs help with note or MPN no and then you will want to clone this language that's we're going to this website will help get this easily so clone this if you need help with that let us know and then we run npm install in here again it's workshop so ask your neighbor ask us and we'll help you David Clarke [Applause]