Research on EIP Security Specifications

Transcript

huh uh so I can start now all right all right greetings everyone so apologies in advance because I'm having a really bad for you right now so my brain is a little bit freeze but I'll try to finish uh The Talk today so uh another another note here so this is not like the super hardcore like uh topic so these are the primer to a research do you we are we're doing currently into the eib security specification so um the content wouldn't be as hard as like uh what what you just heard just now so um let's Dive In so at uh so I'm from salus so salus is a research oriented blockchain security firm um that goes beyond the ordinary smart contract auditing so we try to provide

unparallelevel of trust and security uh so try to be the first one to get in so no other analysis actors can get can can do so today we're going to dive into um the EIP security specification based on our research finding so I'm really I'm pretty sure like most of you have already heard of EIP so I won't spend too much time on like the basics but in a nutshell EIP stands for ethereum improvement proposal uh it's proposal mechanism that drives the Improvement in development of the ethereum network and as well as like Foster the discussion and decision made decision making among other community members so you can cover a wide range of topics protocols updates to new feature introduction to improve security increase transactions

throughput so as you all know like the owners of building consensus within the community and documenting any descent fall on the AIP authors so as we know Erp Encompass uh both underlying protocol changes and as well as like application standard proposal so some notable AIP including erc20 721 1.59 which these EIP has significantly influenced uh the development and the widespread of adoption of ethereum so a little bit of the historical review here so let's refer to the graph and the table here as of July 4th 2023 so ethereum has adopted a total of 71

application standard proposal and 52 core protocol change proposal so however if we look at the graph which is this one so this is the graph that compares the number of replies between the core application proposal and as well sorry the core purpose and application proposal so we can see that on the application side uh they are less frequently discussed if you compare it to the underlying protocol changes proposal so this discrepancy leads to security issues within application standard proposal being less likely to discuss or receive the attention that they require so our study is primarily focus on the application standard proposal this

proposal defined the interface and standards of smart contracts so if these standards has loopholes a large number of smart contracts would be uh we might might have like security loopholes so adopting the standard could also be detected and leading to the potential loss of user fund as well as likely assets so therefore like ensuring the security of EIP is crucial for protecting the security of users and smart contract assets so previous research on EIP security guidelines are primarily focus on the mandatory procurement to include security consideration section in the EIP proposal so this requirement encouraged author to explicitly consider the security in their design you know outline their reasoning and highlight

potential risk so authors are also encouraged to provide an overview of their mitigation strategies or you know explain uh or Justify why are they accepting the risk and furthermore the research promotes a open security discussion um and the summation of new Erp proposal as supplements are bug fixed to previous EIP proposal so as this is a really short speech I won't talk into too much details however um uh This research uh by our research team will also be published as a research paper so um stay tuned to our some of our channels if you are interesting to to learn more uh but in short analyzing previous research on EIP security specification uh We've identified the following shortcomings

first of all is the sorry first of all it's the standardization so while some EIP have been introduced with security consideration there are there's no guarantee that all eips will be as thorough So currently there are no standardized um mechanism or framework guiding the security review as well as like the remediation process of eips which leads to the situation where different proposal May adopt different security mechanisms and specification so result in lack of consistency and comparability next one is what we call fixed

dependency so often subsequent EIP proposal are used to supplement or rectify the issues of previous proposal so this dependency can result in some security issues that remaining unsolved for extended period of time and thereby delaying the enhancement of ethereum ecosystem security and The credibility next up we also found the lack of comprehensive security mechanism while some proposal attempts to address a specific security issues there's an overall absence of comprehensive security mechanism to tackle various type of security threats and last but not least the lack of practical verification so although

certain security mechanism and Remediation method has been proposed they are widespread practical application and full verification are still required for the research and empirical analysis which lack of because of the lack of practical validation it can lead to uncertainties about the effectiveness and feasibility of these methods so in order to address this deficiency in the current Erp security specification we we have embarked on the research on into this security EIP security standardization so our goal is to enhance the security comparability as well as the reviewability of EIP by establishing the standardized code

specification and security processes thereby bolstering the security and credibility of the whole ethereum ecosystem so uh there's there's a lot of experiments that we're currently conducting but this is uh just two of them that we we currently are able to show so we have collected a total of 12 reports and 13 uh for 13 Erp proposal so by organizing the reports um we can categorize the risk uh the type of vulnerabilities that into four types overflow logic access control and validation so uh we extract so these are the extracted medium to high risk uh uh and above vulnerabilities that reported uh

in table three one so and we also further summarize the uh but similar amount of availabilities on table three two as you can see right here so it's kind it's kind of evident that um some the token related uh and logic related issues are the recurrent problems in EIP which these uh can directly impact the user's fund and their assets and then the next experiment so this is one of the experiments we selected um the simple price Oracle uh dot price which was acceptable to integer overflow uh in the all report of erc137 released by consensus uh back in 2019 May yeah so the vulnerabilities originate from

the price function of the simple price oracle.so contract so since the solid language has a limit of the range of zero to two up to the power of two five four two five six minus one or for the U in type values so uh when you exit or false below this range there will be integer overflow or underflow problems because the price function does not check the calculation of the U in type so there will be an integer overflow problem so for such problems like numerical checks um can be added uh simultaneously um the Overflow detection of um the code if it's performed after calculation it will still leaves room for overflow issues so the correct approach is shown here so you actually

detect first and then you calculate so ensure there's no risk of overflow so contractuality is all about being meticulous so very fast as I promise you this will be a really fast speech so some conclusion that our future works as this is like I said this is primer to our Evol like continuous evolving research so despite the mandatory requirement outlined in erp1 to include the security consideration based on IFC 7332 so still there are a lot of issues in historical EIP that Arisen due to the lack of explicit requirement as I have been saying the standardization um the security guidelines uh within the the original security consideration section so in most EIP proposal the

focus is primarily uh on focus on describing the application functionality they do not provide standardized code example so and because of this due to the variation of the developers skills equities or habits there is a risk of them and intentionally introducing code that poses security risk during the developments process especially for like the newcomers uh that they just like joined recently so a little conclusion here so um so how should we mitigate this security risk and based on the comprehensive odd report and security incidents in the past year we can make the following suggestion so it's written down here of course conduct rigorous audience for

financial mathematical models so a lot of this mathematical logic as well as business logic should be taken into like serious consideration when you are doing the audit and we also propose to develop permission control suggestion at for the function at the ERC level and as well as limitation on the usage of scenarios and input restriction for each function at the ERC level limitation on the frequency of function calls such as to prevent your agency also at the ERC level so this is pretty much um the the the the the the speech and the and the uh and the research but as I said the research would be probably done in a

month or two more so it will be published as a research paper and I'll so stay tuned to our to our channel so uh if you are interested to see that the paper and one second all right so uh as I continuously reiterate like these are parameters of the into the continuous research of what we're doing and remains an evolving work in progress so SLS we are researching the security usability and sustainability of blockchain infrastructure and government Sparkle so um one notable example is uh we're currently also working on another research that is that relates to arbitrine so we are researching into the risk involved uh when you migrate your smart contract from other layer to

ethereum onto arbitrim what are the reasons involved and we also frequently educate the public about blockchain technology for instance we aim to publish more of these um research research paper that are more accurate and positive in terms of perspective uh so on some of the reputable scientific journals like science or IEEE so as well as the Affiliated uh Affiliated publication so um this is my Telegram and that is our company link tree so if you're interested to know more or collaborate with us feel free to scan it and I apologize because like I'm still having a huge fever so I will I will have to leave like right after this uh but this conclude my conclude my uh peace

speeches thank you [Applause] yeah one question here okay we will leave you thanks okay thank you um