Integrating Security Into Smart Contracts | European Blockchain Convention

foreign [Music] thank you uh yeah I'm going to do a quick talk here about Security in smart contracts oh there's a presentation slide missing uh to give a short presentation about myself my name is Sean miles from I am working for a company called Banshee it's a a a cyber security company doing offensive and defensive services and we are placed in Copenhagen in Denmark um my background is actually I'm a software developer I've been working with software development for more than 15 years 10 of those years I've been developing intrusion detection systems and malware analysis systems so I kind of know how the attackers work on the default level but today we're going to talk about blockchains and smart contracts and for the past two years I've been working as a smart contract auditor so when we're talking about smart contract security what do we actually mean about that um the idea about Security is to avoid unintended behavior of the smart contract so you don't want it to pay out anything that it shouldn't do but in order to talk about all unintended Behavior you actually need to Define all the incentive behavior and it actually sounds quite like a requirement specification but although it is a requirement specification usually requirement specifications do not specify everything because it's quite tedious so if you're going to to do the opposite of something which is quite tedious you'll find something which is even more tedious and that is like finding all the opposite things so to simplify things when we're talking about Security in smart contracts it's about protecting all these digital assets in any way to avoid any direct or indirect economical losses the consequence of not having Security in your smart contract can obviously be seen from the X price from last year there was a total loss for more than 3 billion US Dollars stolen on the blockchains and these are well-known examples which uh include some some large losses you've actually just heard of the FTX laws like 20 minutes ago a lot after they went or after they declared that they went bankrupt a lot of funds were moved from the company's own accounts and I'm actually not sure that that it's known how the attacker even got hold of the authorization keys but at least a lot of money was stolen and and not under if if tx's control anymore even though there's a lawsuit um in the running Network or the running Bridge an exploit occurred where the attacker came in control of the majority of validator nodes May which made the attacker able to authorize his own transfers and were able to withdraw tokens that he authorized himself Wormhole which is also a bridge the issue there was that they forgot to do some data validation which allowed the attacker to uh to validate his own signatures so he could again transfer tokens of his own choice um yeah I can go on with these no matter which was also a bridge um uh let me see they actually did a small upgrade with a bad side effect that it by default validated uh unprocessed messages on the bridge again this allowed the attacker or actually anybody who who knew how to do it to to transfer tokens um without actually requiring an authorization mango network was a bit of a different hack because the the attacker here invested a large amount of of tokens themselves then he did Market manipulation to change the price and in that way by withdrawing his investment he could actually empty Mango's liquidity um then we have again the PNP chain another Bridge attack again a bad validation occurred which allowed the attacker to transfer his own money so what we're actually seeing here of course there's a lot of bridges I know that but um these issues actually occurred due to design errors in the way the the software should work implementation errors because something was for Gardner implemented in the wrong way and in configuration errors in how how the software was actually configured after it had been deployed or during the deployment and if we look at these um this type of attacks it it looks a lot like the traditional way to do software development this is a traditional waterfall model as most of you developers probably know so you have a design phase an implementation phase a quality assurance phase and then you deploy stuff and do some operations on it today we use agile methods instead but they just iterate through these spaces again and again and again and after each iteration or the goal of each iteration is actually to deliver more functionality now security is part or should be quite part of the quality assurance so the question is why isn't Security in focus so if we look at quality assurance most development teams often focus on the requirement specification requires specifications often focus on the functionality which also limits the quality assurance to only include functional tests so they may be implemented implemented as unit tests integration tests end-to-end tests and maybe user acceptance tests but again it neglects non-functional testing where security is included um if we take a closer look at the purpose of functional testing a functional test should ensure that some expected input deliver some expected output or unexpected Behavior to test security you need to do kind of the inverse of that so you need to ensure that no input exists at all which will trigger some unexpected Behavior and again if that unexpected Behavior can be exploited then you have a security issue so to get security you need to be faster than the attacker because if a hacker can find such a security loophole then he can steal everything and on the blockchain he can often do it in one transaction so there's no stopping when he has stolen the vault so how do we oh there's a timing so how do we actually avoid this or how to how do we get better at this it's actually quite easy and it's almost by the book it's actually just to do things right to do things right you actually need the right people in your team because they have expert knowledge on each aspect or they should have expert knowledge on these aspects that they work on there is no one-man Army in in this so it is important that each role in the team has also has the focus on on their specific purpose they're not all needed all the time but they need to be brought in when needed furthermore when we look at security a lot of mistakes occur because the code isn't understandable you saw the the upgrade error that I mentioned before on nomad so it's it's quite important to write maintainable code and understandable code for us to read and not to make mistakes furthermore it's very important to use continuous integration with automated automated unit testing and static analysis to just clean out all the default issues as an artist I really don't like to to read code which is obvious is wrong I'm actually not doing the basic stuff I want to do the more a non-trivial stuff so that's where these security auditor comes in and the security orders should actually take place before each deployment because if an upgrade includes a vulnerability well then you have lost we don't have time for the examples I can see so I would say thank you for listening and if you have any questions on Smart contract security your feel free to contact me afterwards thank you [Applause]