Capture-the-Flag with Four Beginner Challenges on Ethereum Smart Contract Security

Transcript

morning so we're going to start off the programming for d5101 but before that given that this is the first session we would like to welcome you all to the D5 security Summit which is going to happen well it's technically starting now but we're technically starting tomorrow but today is uh the 101 so hopefully all of you are going to stay back for the summit as well and I'm Rajiv I am the founder and organizer at securium and the first session is a CTF right so if if you look at the agenda we have a maze X which is a capture the flag event so hopefully all

of you are prepared to participate in it so let's uh Dive Right In a quick quick note about securium so securium the mission of securium is to educate and evaluate the security of ethereum right so that's the origin of securium security and ethereum as simple as that and it started as um you may have heard of securium from its boot camp initiatives uh which started in Q4 of 2021 and since then we've been doing a whole bunch of different initiatives so Amaze X is our CTF but we're really known for the boot

camp initiative that's entirely online so what is securium securium is an online community entirely on Discord really of people who are interested in ethereum security and specifically smart contract security right so why do we need this so when securium was created about two years ago even back then well we obviously have ethereum we have billions of dollars of value right in thousands of protocols on ethereum

and all these are secured only by hundreds of experts right so if you look around I mean all you you're all the experts that we are really relying on to secure these protocols and that's not enough right we need more people for various reasons so that is really the mission of securium we want to increase the number of experts in the space we want to welcome people from the web 2 security space we want to welcome people in the web3 space already who are developers and who want to you know get into security or you know get better at security because

ultimately security is best done shift left so we want all the protocols to actually Implement all the security while they develop the protocols right so that is really the mission of securium so it's all about scaling security how are we doing that at securium so we started off in 2021 as a three-month boot camp we called it Epoch zero so that was a three-month boot camp there was new content people you know many of you well some of you may have seen that

but since then from 2022 so for more than a year for about 18 months we've been running the online boot camp and this is what we call as Epoch Infinity so it's an always running boot camp it's all online you can join our discard you can see the QR code there we already have some of the content some of it is already outdated but there you know many of you are producing fantastic content about ethereum about the various changes to it about the various layers about smart contracts I mean there are so many patterns that are changing about all the security hacks the vulnerabilities so all that content is there we need more but you know there's

there's a lot more coming up so as part of the boot camp people read those content they join the securing community on Discord and what happens on a sort of a Cadence is the first one is the race what's a race very simply it's a monthly online smart contract security Chris it's free it's open to everyone you know you can join the Discord there are announcements about when the next race is going to be and who designs these races so when it started off it was me but then the whole of last year we have got fantastic

mentors in securium many of them are speaking today and you know at DSS in the next two days so these mentors are taking their valuable time they come and they help design a race and if you haven't seen one of these it's a very simple 200 lines of smart contract code that has bugs in it intentionally right these are just synthetic examples and the idea is to help people learn about various aspects of smart contact security right so people look at it during the race and it's a very small short race it's it's not like a two-day thing it's just 16

minutes we have a thing with powers of two so it's 16 minutes and there are eight questions right so very short quiz and people take it the answer is all multiple choice there's no you know writing answers I mean it's unlike a CTF it's it's very it's theoretic in that sense so people do these races and we've been having um more than 200 people take these races every month again it's free it's open to anyone right so you just have to jump on the Discord see the announcements uh register there's a window and then you get an access code that's it after that you can participate in all these races there's one every month right and what happens after that so there's a

leaderboard that is published and uh you you know you can opt in for receiving an nft that shows exactly what race you finished how much did you score how many people with all the details so that's cool and then um for a few of the races we have a corresponding care right so the top people from the races maybe the top 16 top 32 they are invited to care that happens in the following month and that care can be different but it's typically uh in the form of a workshop and there securium has collaborated with uh you know the leading projects in the space Sartorius Sherlock trailer bits

most recently verities so we invite people only the top people from that race so if you're at the top 16 in that race and if there is a workshop happening then you get invited you get to learn uh whatever is happening during that Workshop that happens for a week and that is you know that may be a tool it may be about fuzzing it may be um sort of like an audit we had we had some of that a long time ago but most recently it's all been focused on the tools and fuzzing and various other static analysis tools so that that is what care is so Epoch Infinity is really um the races and the cares happening you

know in tandem right so that's that is what the boot camp is but today we are here as aquarium we are a team and we're going to be hosting the CTF and we have some distinguished alumni from securium who are going to be talking about the various CTF challenges so if you have your laptops please feel free to open them up and get started as they explain the various challenges so with that I'll hand it over to Eugene thank you hello to all um before starting I just want to say

the Wi-Fi password is TSS all uppercase 2023 and uh exclamation mark just in case you could also ask everything anything to us we are volunteers here or you could see us in the Pink t-shirts or magenta okay um so well my name is Eugene I started this security journey in the security security boot camp um has been for me it's like six years ago but it wasn't really that long time ago um so yeah we are here um I'm doing like a full-time this this full-time like do it competitive Audits

and you know having fun learning new things um you could ask me anything I had built a few of this Challenge and I think you I hope you get fun of it hi uh it's a pleasure to be here on stage um similar to Eugene my name is Lucas I start out in this space thanks to securium I had no idea about smart contract programming I have no idea about the issues that security had in these smart contracts and yeah start out with securium Epoch zero and I did this part-time doing my PhD in Applied Mathematics

and now I also do audits sometimes at Spirit which is one of our sponsors so it's very nice to be part of a family and all thanks to the boot camp so please if you never joined I think it's a very nice experience because you get to learn a lot you get go to these conferences and meet a lot of people and yeah again please enjoy the challenges we made for you and if you've got if you've got any questions please feel free to ask well thank you Lucas hi everyone it's good to see so many faces at 9 15 in the morning on Friday uh so my name is Pablo and I'm mostly a ux researcher but I've

been in the infosec community for quite a long now like penetration testing and red team and so on I'm currently building a spear without and as you know like we'll be hot in this CTF if you want please do take it and feel free to ask us questions I'm sure that you will learn a lot of interesting stuff and there is please go ahead hello uh my name is Patrick I volunteered in during a Dev connect trustex also in Devcon and I have been I'm a evm security researcher and I have been doing uh contest encoder enough for tertora and hackathons and please don't be shy if you have any

questions please approach us thank you hello I'm lared uh yeah I'm a master student in computer science I'm from Germany um yeah I also volunteered at trustex last year um yeah and I've been doing some internship at Sigma Prime um yeah just having fun in the in the space yeah and the last guy so I think I Ali is missing because he's busy on the entrance um so okay let's start with the first challenge

okay this is uh the CDF instruction sorry so we got the eight different challenges uh three of them are easy you should be able to crack it without any trouble if you know regular solidity uh you got uh there's gonna be a three-day competitions um if you are it depends depending on your skill is how many and how many times you got uh it's how many how do you do it uh big dog always ask for us for help and after that there's gonna be a red app and 30 minutes for explanation and solutions um okay I think it's

so some important D5 Concepts that we are going to treat will defy and smart contract programming concept that we are going to treat during these challenges are first the most important the erc20 token standard um think about the functions think about the ABI of the erc20 think about how the state is handled in these in this standard also flash loans think about how they can impact State how one can modify balance how can that impact other protocols then create and create two up codes some of you know some of you may know these

are used to deploy smart contracts and they function under the hood in very different ways they're used for different scenarios so research how how they work and what are the implications of those differences then automatic market makers you know it's probably the most fundamental building block of D5 we have several several different types we are not going to go very deep in here so as a hint if you're familiar with unique swap V2 that'll be good okay if not take a look at it take a look at the constant product formula um then again the most famous

vulnerability in the space re-entrency attacks I I don't think I have to explain that in depth but for those who don't know re-entrancy attack is a computer science Concept in which a process is interrupted by another calling process of the same nature so which implications does that have in smart contracts what can you do with it what can you break with it that is really important then lending protocols in D5 you may be familiar from several famous hacks let's say for example mango markets for example has been a very a very tough one it has it was a lending

protocol so make sure to research how lending protocols work in D5 that'll give you good hints to solve the challenges and finally Oracle manipulation and collateral liquidation for those of you like me initially who are not really who were not familiar with the economic side of things and check out what Oracle manipulation is what what collateral is what liquidation means and how all these elements play together in in smart contract security so now we can start off with an explanation of the first challenge Eugene please okay so the first challenge is uh mainly

is you choose to warm up uh it's a simpler C20 token uh if you know you don't know what is an rc20 token uh perhaps you should start doing that it's more one of the more basic things that you could build um the the main goal here is that you have to recover 1000 m e that's the name of the token the symbol and redeemed into it again to avoid further losses uh the contract to hack is just magic it um so the concepts that you should consider here is uh that this token is pretty similar to web you could deposit you could withdraw um you could it has an extra

functionality to burn tokens and that's all uh it's basic on a recent hack that were lost like a couple of million of dollars so take in mind that this should this simple but it happen in reality um the next challenge is at first sight could be pretty similar um it's mainly a modern Eid um it's a contract that has locked 1000 it and you have to rescue the those funds um to be honest I don't want to give any spoiler but just take in mind that it's pretty similar to it it has some extra

functionality you could always check the for hints into into the readme just be worried if you open in a plain text editor you will see the hints so be aware of that the third challenge uh the landex this destruction the funny fact that initially the description of this challenge was made by Chad gbt but it was a little bit reduced because it was too much and the purpose for this challenge is um to outline that the code on the blockchain is not immutable and

a couple of months ago due to this uh due to this there was a hack done to a very like a famous and two very famous protocol yes how fun so my challenge one of my one of my challenges is called operation rescue policy token so the what is happening here is that tokens are stuck at an uncleaned address so and there's a factory contract that deploys some smart wallets right so the goal is to get access to the unclaimed address and recover tokens no you will not you'll not have to break

the elliptic curve to find out the private key it's simpler right um so the concepts that we're going to treat here are the creative op code the way to create terministic addresses and how message sender behaves under different contexts right so here for example you can see a pseudocode line that outlines how create2 works that's a big hint and you know below you have a diagram of interactions that I think if you think about who's the caller and what what is message center in each context that'll give you some good hints to solve this challenge so Eugene please

okay um so the first challenge that I present were easy this one is a bit more complex um it's also a bit more fun to do because it's small it's mainly um an RC 36 26 bulb if you are not familiar with that it's just about where where you deposit token and you meet new tokens um so the main goal here is that Ali sambob had got funds in danger you have to rescue them you will start with uh with almost no no eater so it's gonna be a bit trigger you have to to

concatenate different attack vectors yes but the next challenge is safe here um it's about Flash loans mainly um yeah there's a DVI protocol in the center which combines two basic concepts flash loans and the decks um yeah so depositors can earn fees it's like your basic default protocol um your goal is to drain at least 100 Youth and you only start with a little uh yeah so you need to combine those two concepts yeah to drain the pool and yeah that's one one contract and just

for those who might not be familiar but I guess most of you are where the flashlight is here's a basic concept um yeah so the main idea of a flash loan is that it's all happening like in one transaction yeah and it also uses the EFC 3156 standard which yeah just to use the standardized approach of using flash loans so yet another challenge regarding addresses and Cones this call this one is called Crystal Dao it's inspired by a

big Fiasco that happened with some optimism tokens if you may familiar with um speak hint so here we have a factory that deploys ERC 1167 clones of a doll treasury contract and the admin can execute arbitrary logic as long as they provide this signature that shows that they are the admin right and the admin is set on deploy right the goal is to recover the tokens that are stuck at the treasury because somehow the signature of the admin is not working right so a contracts that you'll have to hack are is a crystal dial contract so for for context Concepts that are going to be treated

here is the ERC 1176 minimal proxy standard EIP is 712 signatures very important and the way the EC recover function works right here you have a small small simple diagram of how ERC 1176 minimal proxy work and last but not least if you already got to this challenge then you are a beast and congratulations and this one I'm not gonna spoil it a lot but it may be related to Market manipulations so if you already see uh what was this one

about so Oracle price manipulation and also there might be some collateral liquidation involved there might be so Mev involved but if you're already here and you pass this one then props to you uh looking forward to you guys to solve all of this if you cannot solve any of them then please come to us we will give you hints because our job here is to help you and I think Rajiv has something else to add oh and these are the concepts that these slides will also be uploaded on the GitHub so you will be able to browse through them once again thanks Pablo so yeah um so all these distinguished security alumni design design the CTF

challenges but we also had the help from Patrick who is one of the security mentors we had help from dincho who is another security mentor and stir me who is also one of securium's alumni they reviewed the CTF made sure that there are no obvious bugs and so thank you really for all the feedback so with that we are ready to hack um the QR code in the center is the one for the GitHub repo for this uh you know for the CTF and then we have the telegram channel on the right so

please feel free to use that if you have any questions and this is open for the whole three days so work on the challenges if you have any questions ask us um Ali and all of us will be on the channel monitoring it so if you have if you get stuck or if you have any other questions so please feel free and uh Ali that was it right um we just wanted to share the links uh here are the links for the Discord the GitHub and the telegram and um that's that's about it cool and yeah so as as an incentive we have special Pro apps made for the CTF so if you participate if you would like to get one

then please reach out to Lucas so he has the QR codes for that and uh thanks to the DSs organizers the top 16 participants at the CTF will be receiving a free ticket to the next DSS in 2024 right so that's that's going to be you don't know the details of that but you know we are hopefully sure that uh it will happen so hopefully that is a good incentive as well yeah so reach out to us the main thing GitHub repo and the telegram channel for any questions so we're already there so join

and hack away thank you [Applause] um so we do have we do have time so if you start looking at the repo if you have any questions in the next 15 minutes we're all here so just Reach Out and we do have microphones for any questions so yeah