6 ms·

How to steal Ethers: scanning for vulnerable contracts

93 points by palkeo 8y ago

kolinko 8y ago
Oh nice, and I just published "Show HN" with my symbolic execution decompiler - http://www.eveem.org/ http://www.eveem.org/ Seems like there will be a big trend with all kinds of symbolic execution tools showing up in the upcoming year :)
- palkeo 8y ago
  I link to eveem in my article. I used it quite a lot for my investigation :) Thanks for your great tool!
  - wslh 8y ago
    By coincidence we just published an article [1] comparing automated tools to human auditing in smart contracts. I am reviewing your article for expanding ours. At ethdev[2] someone suggested to check the Slither[3] tool also. [1] https://blog.coinfabrik.com/smart-contract-auditing-human-vs-machine/ https://blog.coinfabrik.com/smart-contract-auditing-human-vs... [2] https://www.reddit.com/r/ethdev/comments/a4492r/comment/ebbnwt4 https://www.reddit.com/r/ethdev/comments/a4492r/comment/ebbn... [3] https://github.com/trailofbits/slither https://github.com/trailofbits/slither
deleted 8y ago
[deleted]
rienbdj 8y ago
have we finally found a way to monetize PL research?
tempodox 8y ago
Isn't that potentially life-threatening because there's a good chance of stealing from criminals?
- Grangar 8y ago
  How would they go about figuring out who did it though? Can't really involve law enforcement in that.
bouncycastle 8y ago
Be careful! There was once a guy who tried to hack an Ethereum smart contract, but in the end the contract hacked him instead: https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-lets-coins-come-in-but-wont-let-them-back-out/ https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-l...
- jstanley 8y ago
  Non-GDPR-walled link: http://web.archive.org/web/20180301075711/https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-lets-coins-come-in-but-wont-let-them-back-out/ http://web.archive.org/web/20180301075711/https://techcrunch...
  - bouncycastle 8y ago
    Excuse my ignorance, but was is a non-gdpr-walled link exactly?
jacques_chester 8y ago
Here's my problem with smart contract maximalism. Suppose my ether gets "stolen". For whatever reason I am able to turn to an external legal framework -- police or a law suit. Why wouldn't I just skip the middle bit and go straight to dumb contracts executed by smart humans, rather than smart contracts executed by dumb machines? What exactly have I gained over the status quo if, at the end of the day, I still rely on the enforcement mechanics of the status quo?
- always_good 8y ago
  Doesn't that simply depend on how often you have to leverage human enforcement? Whether you have to do it <1% of the time vs 100% of the time would drastically change the answer to your question. It's like chargebacks. 99.9% of my purchases I will never issue a chargeback for, so most of the time I choose to use a payment mechanism (cash, bitcoin when I can) that doesn't come with all that overhead. If I was frequently getting screwed by merchants, then my payment habits would change accordingly.
  - URSpider94 8y ago
    Let’s take your example of chargebacks. If you only need to use them 0.1% of the time, then they are worth a 0.1% fee, right? Now, add on the costs of procuring and carrying cash (or exchanging to Bitcoin), the cost of having to hold that money outside of a bank account and not getting paid interest. Then consider the fact that for most transactions, you pay no incremental cost for using a credit card. Yes, that is because the merchants eat that cost, but as an individual there is still no incremental cost to you. Merchants do this in part because they get more sales, and in part because credit cards save THEM money, too - easier accounting, no need for armored car service, less theft or error by employees. Finally, it’s not accurate to compare the chargeback rate of credit card transactions with cash/crypto. Chargebacks for credit cards are very low because vendors are on the hook to pay for the costs, and they can lose their ability to accept cards altogether. If we all move to cash/crypto, the fraud rate will undoubtedly go up. Of course, someone will then create an escrow service that gives you the opportunity to dispute the transaction, in return for a small transaction fee. Maybe they’ll even offer to let you buy things in Bitcoin and pay them back later in cash, and charge you interest. I bet they could add in a rewards program...

93 points by palkeo 8y ago

Oh nice, and I just published "Show HN" with my symbolic execution decompiler - http://www.eveem.org/ http://www.eveem.org/ Seems like there will be a big trend with all kinds of symbolic execution tools showing up in the upcoming year :)

palkeo 8y ago
I link to eveem in my article. I used it quite a lot for my investigation :) Thanks for your great tool!
- wslh 8y ago
  By coincidence we just published an article [1] comparing automated tools to human auditing in smart contracts. I am reviewing your article for expanding ours. At ethdev[2] someone suggested to check the Slither[3] tool also. [1] https://blog.coinfabrik.com/smart-contract-auditing-human-vs-machine/ https://blog.coinfabrik.com/smart-contract-auditing-human-vs... [2] https://www.reddit.com/r/ethdev/comments/a4492r/comment/ebbnwt4 https://www.reddit.com/r/ethdev/comments/a4492r/comment/ebbn... [3] https://github.com/trailofbits/slither https://github.com/trailofbits/slither

deleted 8y ago

[deleted]

rienbdj 8y ago

have we finally found a way to monetize PL research?

tempodox 8y ago

Isn't that potentially life-threatening because there's a good chance of stealing from criminals?

Grangar 8y ago
How would they go about figuring out who did it though? Can't really involve law enforcement in that.

bouncycastle 8y ago

Be careful! There was once a guy who tried to hack an Ethereum smart contract, but in the end the contract hacked him instead: https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-lets-coins-come-in-but-wont-let-them-back-out/ https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-l...

jstanley 8y ago
Non-GDPR-walled link: http://web.archive.org/web/20180301075711/https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-lets-coins-come-in-but-wont-let-them-back-out/ http://web.archive.org/web/20180301075711/https://techcrunch...
- bouncycastle 8y ago
  Excuse my ignorance, but was is a non-gdpr-walled link exactly?

jacques_chester 8y ago

Here's my problem with smart contract maximalism. Suppose my ether gets "stolen". For whatever reason I am able to turn to an external legal framework -- police or a law suit. Why wouldn't I just skip the middle bit and go straight to dumb contracts executed by smart humans, rather than smart contracts executed by dumb machines? What exactly have I gained over the status quo if, at the end of the day, I still rely on the enforcement mechanics of the status quo?

always_good 8y ago
Doesn't that simply depend on how often you have to leverage human enforcement? Whether you have to do it <1% of the time vs 100% of the time would drastically change the answer to your question. It's like chargebacks. 99.9% of my purchases I will never issue a chargeback for, so most of the time I choose to use a payment mechanism (cash, bitcoin when I can) that doesn't come with all that overhead. If I was frequently getting screwed by merchants, then my payment habits would change accordingly.
- URSpider94 8y ago
  Let’s take your example of chargebacks. If you only need to use them 0.1% of the time, then they are worth a 0.1% fee, right? Now, add on the costs of procuring and carrying cash (or exchanging to Bitcoin), the cost of having to hold that money outside of a bank account and not getting paid interest. Then consider the fact that for most transactions, you pay no incremental cost for using a credit card. Yes, that is because the merchants eat that cost, but as an individual there is still no incremental cost to you. Merchants do this in part because they get more sales, and in part because credit cards save THEM money, too - easier accounting, no need for armored car service, less theft or error by employees. Finally, it’s not accurate to compare the chargeback rate of credit card transactions with cash/crypto. Chargebacks for credit cards are very low because vendors are on the hook to pay for the costs, and they can lose their ability to accept cards altogether. If we all move to cash/crypto, the fraud rate will undoubtedly go up. Of course, someone will then create an escrow service that gives you the opportunity to dispute the transaction, in return for a small transaction fee. Maybe they’ll even offer to let you buy things in Bitcoin and pay them back later in cash, and charge you interest. I bet they could add in a rewards program...