11 ms·

Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

100 points by mikece 8y ago

baby 8y ago
It's a pretty interesting topic/field to get in if you're a security researcher, just because everyone is starting from zero and a lot of vulnerabilities are quite surprising. If you're interested we've made a TOP 10 of issues with smart contracts here: https://www.dasp.co https://www.dasp.co
deltateam 8y ago
> "Typically, these would consist of non compliance with the ERC20 standard" Given that ERC20 standard was ratified in the 3rd quarter of last year, ~70% through the year, and only ~70% of ICOs had this issue...
deltateam 8y ago
> ..contained vulnerabilities in smart contracts, the heart and soul of an ICO > Once an ICO starts, the contract cannot be changed and is open to everyone Many teams have upgraded their contract without an issue. The market has stopped reacting to it completely. They just release a new contract and airdrop it to all existing holders. Notify the exchanges, and it is business as usual. This is more of a FYI. I'm not really curious about what this particular research group is doing, or why this article uses "vulnerability" without the distinction of how benign these things are.
- nemild 8y ago
  There are still downstream effects with this. Exchanges, financial products on top, all have to deal with this. And this also goes against decentralization.
- gnarcoregrizz 8y ago
  Airdrops don't seem like a complete solution to me. If someone sells a lot of stolen/hacked tokens, it still decreases the value of the airdropped tokens, since there's absolutely no recourse once the stolen ones are converted to something else. The only way to stop a hacked contract from becoming a problem is if every path to liquidity is immediately halted, but I'm not sure its realistic to do that. I'm sure there is always a long tail of exchanges and holders still transacting in the hacked tokens. People are still transacting in ETC, lol. People not caring is probably just due to the crazy risk and volatility in crypto in general.
  - deltateam 8y ago
    Most "smart contract vulnerabilities" don't involve the ability to steal them. Again like I said, I don't know why this article doesn't point out how benign most of these things are. so for the one example you presented, thats right it isn't a complete solution, and that one example requires its own individual discussion. This article doesn't distinguish about the level of severity of the vulnerability the reality is that most of these are as benign as any random website not getting 100% in a cursory test
- api 8y ago
  If that's what they're doing then why not just do an auction on a web site? What's the point of using the block chain if your solution to any problem is to go around it anyway?
  - deltateam 8y ago
    The idea is generally to get to the point where minimal maintenance is necessary The distributed ledger technology makes it easy to offload accounting and user management, which helps you quickly bootstrap the supply and demand side of a network much faster while coupling that with the capital you need or simply want. These are typically catch-22 problems for other kinds of networks, VC backed or otherwise. It is dime a dozen in silicon valley to have a company that raised 10 million in a series A to barely have 10,000 users before ultimately closing the doors and giving nothing to its vested common stock employee/holders. Not too much different with ICOs, except people get more than nothing and don't have to wait for it.
nemild 8y ago
So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a beta process. 6. People prematurely optimize gas, at the cost of readability (For non-Ethereum devs, here's a short tutorial for how the language works: https://learnxinyminutes.com/docs/solidity/ https://learnxinyminutes.com/docs/solidity/ ) My own view is that you have to code expecting that things go wrong, and ensure that your logic survives inevitable mistakes ('resiliency'). There's a lot of great resources on security, for people interested in this space: Ethereum Safety: https://github.com/ethereum/wiki/wiki/Safety https://github.com/ethereum/wiki/wiki/Safety Decentralized Application Security Project: https://dasp.co/ https://dasp.co/ Consensys Smart Contract Best Practice Guide (I helped coauthor this back in 2016 after the DAO): https://consensys.github.io/smart-contract-best-practices/ https://consensys.github.io/smart-contract-best-practices/ Hacking Distributed is a great blog for blockchain security: http://hackingdistributed.com/ http://hackingdistributed.com/ Emin and Phil Daian are great to follow on Twitter: https://twitter.com/phildaian https://twitter.com/phildaian https://twitter.com/el33th4xor https://twitter.com/el33th4xor Audit Checklist (written by my team): https://github.com/cryptofinlabs/audit-checklist https://github.com/cryptofinlabs/audit-checklist (Disclosure: Our team does audits for a few projects: http://audit.cryptofin.io/index.html http://audit.cryptofin.io/index.html ) Feel free to add other resources to this thread. Imagine it'll be useful for everyone.
- vec 8y ago
  > Blockchain smart contracts are often unchangeable, so you can't fix bugs This is the fatal flaw with smart contracts as a concept. If they can be changed by the author then they don't provide the security guarantees that make the system worth using, but if they aren't changeable by the author then a huge fraction of smart contracts will ultimately end up doing something unintended because of any of the million reasons we don't normally expect first releases of alpha software to work perfectly in all circumstances. In a perfect world Etherium would work great, but we don't live in a perfect world. People make mistakes. Any system which expects human input but isn't designed to gracefully handle human error (including the humans who programmed the system) is probably not going to end well.
brighton36 8y ago
What's the difference between a token and a receipt? without legal obligation, it seems that what you're getting is a proof of purchase.
woah 8y ago
This is from an auditing agency, so by definition these flaws were solved. Most ICOs get multiple security audits. How many startups can you say that about?
technion 8y ago
and also failed to register all versions of an ICO domain Surely that's just not feasible these days with the massive amount of TLD's available. I've been in businesses that wanted to own domain.com, domain.net, domain.org, domain.co.uk, domain.com.au, et al and it was a "vulnerability" if you missed one. But with hundreds of TLDs and some costing hundreds of dollars a registration, this has to be seen as a lost battle.
- abritinthebay 8y ago
  Doing the top 3-5 should be trivial though. Some just have those oddball tlds (ie, bloc.kcha.in or whatever) and nothing else
- aussieguy1234 8y ago
  Correct. Heres a full list https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...
bunkydoo 8y ago
If you founded an ICO in 2016-2017; your chance of survival as a human being === low. Looking at you Vitalik B.

100 points by mikece 8y ago

baby 8y ago

It's a pretty interesting topic/field to get in if you're a security researcher, just because everyone is starting from zero and a lot of vulnerabilities are quite surprising. If you're interested we've made a TOP 10 of issues with smart contracts here: https://www.dasp.co https://www.dasp.co

deltateam 8y ago

> "Typically, these would consist of non compliance with the ERC20 standard" Given that ERC20 standard was ratified in the 3rd quarter of last year, ~70% through the year, and only ~70% of ICOs had this issue...

deltateam 8y ago

> ..contained vulnerabilities in smart contracts, the heart and soul of an ICO > Once an ICO starts, the contract cannot be changed and is open to everyone Many teams have upgraded their contract without an issue. The market has stopped reacting to it completely. They just release a new contract and airdrop it to all existing holders. Notify the exchanges, and it is business as usual. This is more of a FYI. I'm not really curious about what this particular research group is doing, or why this article uses "vulnerability" without the distinction of how benign these things are.

nemild 8y ago
There are still downstream effects with this. Exchanges, financial products on top, all have to deal with this. And this also goes against decentralization.
gnarcoregrizz 8y ago
Airdrops don't seem like a complete solution to me. If someone sells a lot of stolen/hacked tokens, it still decreases the value of the airdropped tokens, since there's absolutely no recourse once the stolen ones are converted to something else. The only way to stop a hacked contract from becoming a problem is if every path to liquidity is immediately halted, but I'm not sure its realistic to do that. I'm sure there is always a long tail of exchanges and holders still transacting in the hacked tokens. People are still transacting in ETC, lol. People not caring is probably just due to the crazy risk and volatility in crypto in general.
- deltateam 8y ago
  Most "smart contract vulnerabilities" don't involve the ability to steal them. Again like I said, I don't know why this article doesn't point out how benign most of these things are. so for the one example you presented, thats right it isn't a complete solution, and that one example requires its own individual discussion. This article doesn't distinguish about the level of severity of the vulnerability the reality is that most of these are as benign as any random website not getting 100% in a cursory test
api 8y ago
If that's what they're doing then why not just do an auction on a web site? What's the point of using the block chain if your solution to any problem is to go around it anyway?
- deltateam 8y ago
  The idea is generally to get to the point where minimal maintenance is necessary The distributed ledger technology makes it easy to offload accounting and user management, which helps you quickly bootstrap the supply and demand side of a network much faster while coupling that with the capital you need or simply want. These are typically catch-22 problems for other kinds of networks, VC backed or otherwise. It is dime a dozen in silicon valley to have a company that raised 10 million in a series A to barely have 10,000 users before ultimately closing the doors and giving nothing to its vested common stock employee/holders. Not too much different with ICOs, except people get more than nothing and don't have to wait for it.

nemild 8y ago

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a beta process. 6. People prematurely optimize gas, at the cost of readability (For non-Ethereum devs, here's a short tutorial for how the language works: https://learnxinyminutes.com/docs/solidity/ https://learnxinyminutes.com/docs/solidity/ ) My own view is that you have to code expecting that things go wrong, and ensure that your logic survives inevitable mistakes ('resiliency'). There's a lot of great resources on security, for people interested in this space: Ethereum Safety: https://github.com/ethereum/wiki/wiki/Safety https://github.com/ethereum/wiki/wiki/Safety Decentralized Application Security Project: https://dasp.co/ https://dasp.co/ Consensys Smart Contract Best Practice Guide (I helped coauthor this back in 2016 after the DAO): https://consensys.github.io/smart-contract-best-practices/ https://consensys.github.io/smart-contract-best-practices/ Hacking Distributed is a great blog for blockchain security: http://hackingdistributed.com/ http://hackingdistributed.com/ Emin and Phil Daian are great to follow on Twitter: https://twitter.com/phildaian https://twitter.com/phildaian https://twitter.com/el33th4xor https://twitter.com/el33th4xor Audit Checklist (written by my team): https://github.com/cryptofinlabs/audit-checklist https://github.com/cryptofinlabs/audit-checklist (Disclosure: Our team does audits for a few projects: http://audit.cryptofin.io/index.html http://audit.cryptofin.io/index.html ) Feel free to add other resources to this thread. Imagine it'll be useful for everyone.

vec 8y ago
> Blockchain smart contracts are often unchangeable, so you can't fix bugs This is the fatal flaw with smart contracts as a concept. If they can be changed by the author then they don't provide the security guarantees that make the system worth using, but if they aren't changeable by the author then a huge fraction of smart contracts will ultimately end up doing something unintended because of any of the million reasons we don't normally expect first releases of alpha software to work perfectly in all circumstances. In a perfect world Etherium would work great, but we don't live in a perfect world. People make mistakes. Any system which expects human input but isn't designed to gracefully handle human error (including the humans who programmed the system) is probably not going to end well.

brighton36 8y ago

What's the difference between a token and a receipt? without legal obligation, it seems that what you're getting is a proof of purchase.

woah 8y ago

This is from an auditing agency, so by definition these flaws were solved. Most ICOs get multiple security audits. How many startups can you say that about?

technion 8y ago

and also failed to register all versions of an ICO domain Surely that's just not feasible these days with the massive amount of TLD's available. I've been in businesses that wanted to own domain.com, domain.net, domain.org, domain.co.uk, domain.com.au, et al and it was a "vulnerability" if you missed one. But with hundreds of TLDs and some costing hundreds of dollars a registration, this has to be seen as a lost battle.

abritinthebay 8y ago
Doing the top 3-5 should be trivial though. Some just have those oddball tlds (ie, bloc.kcha.in or whatever) and nothing else
aussieguy1234 8y ago
Correct. Heres a full list https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...

bunkydoo 8y ago

If you founded an ICO in 2016-2017; your chance of survival as a human being === low. Looking at you Vitalik B.