The streets of Dark Forest are paved with gold

Transcript

my name is where should i stand to not cover it my name is damian i'm a security researcher and consultant in securing company and actually i was going to be here last year but i couldn't manage it because of covid of course and there is my presentation from from last year if you are interested and today i'm going to talk as a researcher and to to be a researcher you have to go and make some research do some research so this presentation is uh a brief story of of my research i'm gonna i'm gonna show you how i do research and how you could do the security research if you

if you're interested in that so to start the the most important thing when you're studying research is to define the scope because if you do not define narrow enough scope you're gonna do your research for a long time and you know ideally you'd like to finish it so that you can present it next year right so it's important to to define what you want to focus on where to start what kind of contracts you want to check what kind of functionalities you'd like to check and this will allow you to you know focus on the specifics on and finish your research in a reasonable time and after you do good

scoping it doesn't mean that we'll have no destructors right so i also show you a few examples of destructors and how to handle them because if you if you have too many instructors and if you follow all of them again your research is like gone because you you're not going to finish it and sometimes sometimes those distractors end up with pivoting which is not nothing bad but if you do too much pivotings again you're not going to finish your research so so i started with okay i started with initial scoping because you know the defy applications consist of many components and you can think of the infrastructure which are the nodes then you have the the default

application which has a front-end application which is usually javascript and backend applications which are always smart contracts and also sometimes other web applications like bots which monitor your application and just call so some functions if needed and i was not i i didn't want to go uh to do research with the node because i have no not much experience about low-level code like like go or c or whatever i didn't also want to go with web applications either front-end or back-end because i'm i've been doing it for years and i just wanted to try something else

and that's why i ended up with ethereum smart contracts i mean not ethereum but evm-based mod contracts and what's great about that is that you're you're not limited only to ethereum because you actually can check smart contracts on different chains like polygon or or even binance matching right so it's still a huge scope right it's not yet finished i i haven't yet finished scoping and i was looking for some inspirations for the research and one source of the inspiration for me is are the audits for clients and we had a situation we had a client that was um going was deploying a token with a pre-sale functionality which is quite common right some kind of

crowd sale and in the token itself you could buy their tokens in the token contract you could buy their one ten thousand tokens for one hetero and then they planned to run the to deploy the uniswa pool where the initial price would be nine thousand after nine thousand you would get 9000 tokens for one ether so if they don't stop the pre-sale i could easily buy 10 tokens for one editor on their contract and then sell them for more than one letter on the on the uniswapo uh fortunately for our client was safe here because they

managed to stop uh they stopped the crowd sale before they launched the pool but well it's a good idea for research right so are there any other projects that have the same situation they have crowd sale or pre-sale and they have a uni swap pool and maybe they forgot to you know finish their pre-sale so the idea was to look for tokens that have both uni swap pool and that's easy you can check it on coin market cap easily and also that have crowd sale and that was hard to find for me and also the you can think of the possibility of success because sometimes you think like it's it's pointless to

check that i'm sure that most or all the projects have finished their crowd sale before they start they deploy the the pool right but still if you are doing research expect unexpected if if you do not check it you will not be sure right and i'll show you that you should check all those uh all those assumptions that look very uh less [Music] possible so let's find these tokens i'm ready for for my research now and here comes the first destructor because i i was looking for the tokens with crowdsale and it was quite hard because there is now like place where you have a list

of them i was referred to the bloxy info by bitquery however and also they had that token sale list that was the the place i was looking for but unfortunately it stopped working it wasn't working so now after some time i also know that they have some a tool called graphql also by bitquery which is cool and probably that could solve my problem back then but i just was trying to play with bloxy and try to find a way to make it to work it i just played with some http requests and it doesn't matter really because i came up i came upon uh address which was called a dice game

so some kind of game with randomness sounds sounds nice so let's play this game and also there was a two eaters on these contracts and the third thing was that it was two years old so like quite old contract right so i i thought that we should check what's there how they how do they handle randomness which is not a trivial problem in in ethereum right so actually they uh they had that function called bet by et eth can you see it okay and they used as the seat they used a function that they did some hash operations on the

block timestamp block difficulty message sender and some private key which yeah that sounds weird if you have a private key in the contract but it doesn't matter here the what's important is that it doesn't change the private key is constant here i don't even know what its value but what's nice for me as a player here is that this function is public so actually i can use their function to get their winning number that they use to check whether i won so this is the times when you want to go deeper and check this so it was not that easy it was not only one contract that there were three contracts citizen dice game and token the you had

to play you had to first register then you could play and if you win they they pay out through the token contract so and the how do they calculate the price you better number like in this example i bet 60 and the numbers are from 0 to 100 so i bet 60 and i'm saying that my number will be higher than your number your your random number and so the random number was 30 in this example so they what they do they take the amount that you bet they multiply it by almost 100 it's 98.5 here and divided by your number so here in this example i would win uh 1.64

but if i bet 31 and say that it will be higher i would earn much more right twice more almost twice more so if you know the the number if you know that it will be 30 you can easily find the the number that's the the best that gives you the best outcome so this was my contract i used to to play this game and what's important here is that i'm just using their their function and do their module 100 because that's what they do to get the winning number and some additional stuff i wanted to control how much i can win here so it doesn't really matter but

i just call their their function to to get my to get my reward right but it's quite hard to you know play in dark forest because you can be front run you can just you can your code can just not work right and it's quite costly that time when i was playing that the the gas price was like 150 something like that which was quite quite huge so uh to deploy my contract i had to pay 150 in dollars and to one try one play will cost me like 60 dollars so i wanted to make sure that it works right and that that's that's why you want to

do your own dark forest which would you call you would call light forest because it's owned by you and what i mean here is the main networking so the main networking allows you to take the current state of the mainnet and like transfer it to your local node it's not even node your local environment and all other operations that you do you are doing locally and but on the current state of mainnet so you're just that's why it's fork right and it costs you nothing because it's local you lose everything after you finish but it doesn't matter i just want to make sure whether it works for for now you can easily achieve that using using

hard hat and for example all hemi io where you just defined where you defined the network and started as a main network you write your code so i deployed my attacker code i just call make citizen function which registers in the citizen contract then i i call my function that i showed you before to play to get my reward and also you have to remember if you are playing through a contract you must remember to implement a function a function that will allow you allow you to withdraw the price from your contract because if you forget that

the you will win but it will be locked in your contract and you'll have no control over over this eater or any other token and you just simply run it like you run tests in hard hard and what's cool about main networking is that you als you have additional features that you do not have of course in mainnet like impersonating a particular address so you can like become anyone in your main network uh or even just changing some storage in in any contract you want i wish i could that on mainnet right and also this works not only for heart cut it works also for brownie and garnish so

this was the the first distractor which was fun and gave some some profit after i i told you that there were two eaters there on this contract however it cost me some but also there was a limit so you couldn't win those two eaters and that's why uh it was a good idea to run the test locally on main network because i just realized that during testing right and well there is a question open question whether it's still gaming did i just play the game according to the rules or is it hacking because i just tried to obey some some rules right actually i don't know the answer to this question so if you

know the owner of this address who is the deployer of that game just let me know we'll make sure that it's the person just you know sign a message using this address and i'll give it back i'll give the the reward back all right so that was fun that was some profit but i need to go back to my research because i haven't even started it right so i just did some scoping and here comes the second instructor that was the time when have you heard about sparta protocol it's on binance smart chain so probably most of you haven't heard about that but that was the day or a day a few days later

where sparta protocol was hacked and they lost like 30 million dollars because of some improper shares calculation and and using like imbalanced pool via flash loan and so on and so on so i was like my research is not going very well because i still don't know how to get those tokens the crowdsale tokens so maybe i'll have a quick peek here and check how their token look like so i won't still still be like within the scope so i want to check um what are the transfer functions what are the mean and and burn functions in their token so and look for some interesting stuff and

i found uh yeah an interesting function called transfer to can you see it from back there can you see the code here cool okay so as you can see they they it's not transfer it's not the typical function it's a transfer to function and what they use they use tx origin so actually and also this is this is public so basically if you okay if you allow if somebody calls your contract and you call this function you can transfer all sparta tokens on the behalf of the sender right so you can steal their functions

steal their tokens and the first question was actually why did they use it and to be honest i don't know um i suppose they use it to omit the approve and transfer requirement right so they didn't have to call firstly approve and then transfer they can easily make their users transfer the sparta tokens with this with this function because look here so there is a function remove liquidity whatever when the user calls it they call the transfer to function on the pool because pool also had this function and and the user would they would send these units to the pool

on behalf of the user so user didn't have to approve it right quite risky and actually it is risky because have you are you thinking about any possible scenario here so how can we steal those tokens how can we steal the sparta tokens from from users they're the first yeah exactly that's that's the first yeah so the idea was to make actually the idea was like this one right make people make people uh call your contract the people who has some sparta tokens right to call your contract and then transfer their contract

within your contract right so from your contract you're calling this transfer to and however this is first too hard because i have to convince people so i have to do some kind of phishing campaign or just you know do it any other way but still that's that takes some time and it's costly and also if somebody checks out my code because you you want to verify your your code right so if somebody checks my code they will see that there is a bug door there right so it's not that it's not the best idea to attack those those people however we can make some exchanges like atm machines we can like get money from exchanges like that i mean

of course in terms of sparta token because what you would do you would simply ask the exchange to withdraw your bnb because it's on binance marching to withdraw bnb right and exchange is fine with that because people are withdrawing bnb and utah withdraw this bnb to my contract to my address which is a contract so exchange makes this transaction to my contract address and then in the receive function or fallback function whatever you call it i say also by the way don't forget to send me all your sparta tokens right so i'm calling the transfer function on behalf of the exchange

and there are two limitations here first the exchange has to keep and use the same address to withdraw both bnb and sparta right because they have to have sparta on their bnb address and the second one is they have to give enough gust limit for this transaction to make me to allow me to call the transfer to function and i ended up with three with three exchanges that you know meet that met the requirements and it's actually it's quite easy to find the exchanges right you go to the heteroscan or bsc scan and check the

holders tab and you see those big holders there these are probably exchanges and if they keep both bnb and other token or multiple tokens that's for sure exchange or some whale so i found three and have you seen the film the movie good bad and ugly it's it was exactly the same here there was a good bad and ugly exchange the good one was like they they when i contacted them they responded very quickly they transferred all the sparta tokens to another contract so that they do not use the same contract to withdraw both bnb and sparta and also they they responded fast they they checked that and they

gave bounty and the bad one was uh i would say no there's if you you should avoid it here it's duplicated and also they they will change it they have already changed it so the second one the bad one was the one that said it's not our problem it's sparta bug so we don't care but they transferred all the sparta tokens to another contract so they were at risk but they didn't give a you know and the ugly one was the one that didn't even responded so probably they might be still at risk but then i also contacted sparta team of

course so they were after the first hack so they were migrating to the new version of their token and in the new version they they removed the takes origin so it was not you know it was not the case anymore okay so the summary of this uh destructor was the first but i was surprised that there is dx origin in use still uh also that it was fun to create this exploit and check you know the the time when you see on the main network that it works you're like you know you're having great time and also a nice profit in the in form of bounty and the other

thing was that i had another idea for the research i just you know ended up the first one because i couldn't find those tokens and i actually pivoted the research that was not yet started right so idea was the change was that i want to focus on the tokens that i can easily find so i took the tokens listed on big exchanges i took the list from coin market cup for binance and for coinbase and i want to quickly check i don't want to focus a lot spend a lot of time on them i want to quickly check the the most important functions how do they transfer how do they meet and how do they burn the tokens uh and you know i had of course some doubts because

if if you want to be listed on coinbase or binance you probably have to be audited right so and not only once so probably i will not find nothing but as as i said before expect unexpected and of course if i didn't find nothing if i didn't find something i wouldn't be here so and also destructors there there were two already before i start so no more distractors if you find something interesting write it down for later and and come back to them later you can end up after first research you can end up with many ideas for another researchers okay so i selected 40 40 tokens on from binance and 30 from coinbase

21 of them were not evm based so i just didn't check them and the rest the rest almost the rest were fine there were two with some findings and that's because you know you have all those uh opens up in implementation so that the rest was mainly the implementation of open zebra and years it went so there were two quite interesting findings excluding sparta of course the first one was the band token where they had a interesting function called transfer and call this function is actually quite common but not in this form because here the transparent call function is the

function where you first transfer and then call some function on the receiver if you are familiar with 1155 as far as remember they have that on received function but in this case i was i could control the signature of the function so actually i could make the band token to call any contract any function the only limitation was there had to be two at least two parameters where the first one was the address and the second one was the value so it was it was uh address and it was you in 2256. so again we have some findings some

interesting finding now you can think you we have to change our mindset to the other career and think of any possible threats here and there might be more so if you have an idea you can let me know or you can just do the research on your own but when i looked at their code it looked they had some other tokens this is the contract of the of the of the token of the ban token and as you can see they had some and actually they still have some solar token at the day when i was pre creating this the store token was 151.93 and the band was six dollars now it's much less of course because

it's going down lately but still what you can do here is that you can call the transfer and call function to transfer about 11 band tokens to the sora contract sora token contract and make uh oh and the call on behalf of band token the transfer function on sarah token to transfer these sort of tokens to you okay so basically i lose 11 i lose 11 band tokens because because i send them to the soro token contract but bank token gives me back 11 solar tokens and which are worth much more so

actually you can easily and that's that's the whole exploit for that and actually i i didn't even call that right so it's still there if you want you can do it because i contacted the band token team and then told me they told me that okay thanks that's not a big deal we will send it back to the someone who sent send those star tokens to them and when i was preparing this presentation a few days ago i looked there because i wanted to know what's the price now and it was like it's still there so i'm not touching that but this is the code that you can use you just need to get some bunch tokens this is the code you can use yeah you're taking pictures we'll see who's

who's first watch out who's leaving the room uh okay so this is the code sorry this is the code that you can use to get 11 zoro tokens so easily like fifteen hundred dollars are there on the table okay so this is what the first finding the second was the second one was even more interesting because this was in the in the teller uh token uh i was looking as as i told you for some custom logic right so they had that do transfer i'm pointing here they had that do transfer function where they had this was simply called by the transfer function right so

it's you can think of like this is the transfer function uh so they they had two requires which are completely fine and there was another one quite interesting so this is the function allowed to trade which is on the other side and they had a special case because this part is fine if you have more than you want to send it's cool however there was a special case when you have some kind of i have no idea what that is yet right i'm just looking at the code i'm just reading the code the names and the numbers uh so if you are not zero status and it's below five then there is a special case

because you have to actually have more than just uh the amount you want to send and there is a quite easy to spot back here and here's the hint i i'm not sure if you can see it but the hint is it's below 0.9 0.8 version the solidity can you see the bug anyone all right so yeah just one word almost it's underflow but yeah yeah the there are like almost the same there is an underflowing here right so if you if your balance is

smaller than the stake amount and stake amount is 500 token you have uh underflow here and your amount is like for sure much bigger than the amount you want to send right and there is no additional requires for for that so if you if you manage to actually get to meet two requirements you are able to get all the tokens right and the first one was that you have to change your current status so uh yeah the first one and the second one you have to make your uh make your balance below 500 because this is the stake amount and it did it

this one was quite quite hard to find first but let's start with the first one and as i told you i have no idea what i'm doing i mean i haven't checked the code like from scratch to you know from end to end i i don't know uh what's the business goal and so on so but i find i can read the code right so i found the code the the function deposits take which changes the current status okay first of course i check it on the main network locally and it works cool i have met the first requirement but now the problem is that from now on you have to to become a staker because that's what's

going on here you have to have uh at least stake amount uh tokens that that has to be your bonds right and from now on they check whether you have more tokens so if you want to send 10 tokens you have to have 510 tokens at least right so this was the the second requirement i need to make my balance be below 500 and you can do it by burning your tokens right so there is another function is called tip where you basically tip somebody i have no idea whom and and why but what's important here is that i burn

some of my tokens right so i can make my make my balance below 500. yeah and actually if you understand that if you find those functions that you know let you meet this requirement that you meet these requirements the exploit is quite easy because you just need to here i just get some tokens to to be able to call the deposit stake so i had to have more than 500 so then the the real attack starts here i just deposit called the deposit stake to make my current status equal to one and then i call attip

i type somebody with id a1 whoever it is and i send i tip them with two tokens so that my balance is 4.99 now and then i do some transfer any transfer for any amount just to make sure that the underflow happens and updates my balance right and after i do it my balance is like huge i should probably show it here so that you can see how huge that is but it's of course close to the maximum of viewing to 56 right all right so after i found it after i proved the correctness of my exploit on the main

on the on the main network of course i contacted the team and on telegram and that's how you you know how to find the team sometimes you can call them on their telegram but none of them i mean not all of them are very responsive and you have to find another somebody who's in charge for security in this project if there is somebody and it's good to be on the so sorry again for that and and i got the bounty from from the team so cool right again fun and profit so to sum up the research if you want if you are thinking of doing research do it i mean try it you may not be

successful but it's always at least fun and knowledge and i'm sure from time to time and it will get more often it's also a profit but it's important to do the scoping to finish it in reasonable time and do not get distracted much and if you are looking for inspirations this was the case when the inspiration came from thursday audit you do not have to be auditor you can just try to audit by yourself some some project without their permission because you're not touching their main net contracts so you can like play being an auditor just to look for some inspiration or you can read about hacks they give also nice

inspirations or maybe presentations like this one that the first the first idea for research was not finished it was not started even so maybe you wanna we wanna try that if you do that let me know so uh i'm sure that i'm not going to follow that again okay and don't be afraid of impos so-called impossible research ideas just check it check it as us in the laziest way you can i mean do not spend a lot of time just check if you can easily find it or something uh yeah but now who's who of you is a developer yeah there's plenty of you cool so it's not like i want to be as somebody who

is looking for bugs in the deployed contracts and you know ruin your holiday or something i want to give somebody something to developers to not be the you know the victim of such research so uh what are they how how not to be the victim of the research like this yeah first of all audits i know everybody knows that right and it's not very easy to to get one the other one is also quite important and quite common the the tools that you should integrate in your ci cd there is plenty of them and they are open source so why not using them but what is more most important in my opinion is

shifting left so what you should do as a team as a dev team or as a team as a whole you should start thinking about sacred not thinking start doing security as fast as you can i mean you have an idea you have your documentation start doing security review you do not need code to start to to do security reviews you can check out the the ideas that you have you should before you start even implementing your project you should do threat modeling so that you can identify potential threats you can identify those those threat actors who can who can attack you how they can attack you and i mean what

they were looking for probably for your token or any other asset that is worth that worth is worth a lot and think of change your mindset to the attacker and you can do it actually internally in your team you can just you there's no nobody else who knows your project better than you right so you can think of the possible uh abuser stories that's what we call them because if you you i'm sure all of you have those unit tests when you check whether everything is functioning correctly right so do the other part of unit test when you are implementing the absolute stories so how somebody would like to attack us right and they may not be successful

but they may become successful after you add some functionality to your project right so it's do not think only about the optimistic flow remember about the attackers flow and also do use the security checklist and if you are talking about security checklists i want i would like you to show to you our scsvs which we call smart contract security verification standard it's an open sourced checklist security checklist for for developers and for auditors and for architects as well we try to cover the whole is the sdlc from design phase and not finishing on the implementation

but also during the maintain maintenance maintenance of your project right so it can it covers both technical and business needs if you're a business if you're in business in your protocol you want to know what's red and what's green right you you don't don't want to go in to the code you don't want to check the code you don't care about the code you just want to be sure that your project is secure so this could be also useful for business so that they know how many reds we have and we should take her off also we have a ready to use spreadsheets for that and so you can find them over here or just simply contact me on

twitter or via email or link in whatever telegram my telegram handle is the same as twitter's handle so you can find me also on telegram so thank you [Applause] yeah 37 minutes i made it are there any questions yes just wait the microphone i can repeat the question uh just how long did it take you overall like your research like this uh actually i'm quite

lazy so it took like a month but i was doing audits on the daily basis so if if you sum up it would be like two or maybe three weeks not that long if you define the scope correctly i mean if you very narrow it it's of course you cannot find anything and but still you do it very quickly so you can have another idea later okay have you heard about a project called the securium it's a bootcamp for contract auditing and security yeah

there are there are a few bootcamps coming i guess at least i've heard about three at least so yeah i've heard about it if you if you wanna start doing some security i i think and you're like on the entry level i mean you're not very familiar with this security staff yet i think that's yeah it's a good good to try i it wasn't done before so i have no any any experience with that i don't know whether it's good or bad so i cannot recommend it or not recommend it but i think it's worth a go and those those are free i guess now you have to ask

all right so i see no no more questions so thank you again [Applause] you