Wake: open-source Swiss knife for Solidity developers

Transcript

okay so let's start it uh first uh question uh are there any solidity developers at least B ones like I am okay so I will try not to make it too much technical but provide like bigger overview uh so yeah I'm going to speak about open source tooling and I'm Joseph I'm co-founder of Aki uh blockchain security we are smart contract Auditors and and uh we are also from the very beginning big Believers of Open Source so we are uh constantly trying to develop some tooling that will be beneficial also for uh for the others uh so everyone is free to use uh the tools

that we produce and this would not be possible uh without uh our clients that uh pay us for the Audits and from the profits we can be doing uh such stuff as creating open source so uh thanks to save or acceler and uh many others that we are working with we also got a grant back in the day from ethereum Foundation we got a grant that supported development of this tooling from coinbase so all these uh big players uh helped us to create the tool before I deep dive into the Tool uh I will just do a quick recap of some let's say best practices in

security uh we see security like this so we are Auditors we are selling this part of security which is the most expensive one but I openly admit that it has the lowest impact uh so basically the most impact in security is still on the development teams and these are the uh four stages the developers can do themselves they don't need Auditors for that and uh so what is it uh the very beginning of course some best practices still we are seeing some repost for example created by one developer this doesn't work uh so of course do your uh peer review uh there is a GitHub flow

for that so just use it uh Second Stage everyone can do it for free it's about tooling so if you just select the right tools to secure your code uh you get some extra uh layer of protection and security so there are tools such as slitter which is the static anline from 12 bits there's hour uh framework there's uh many commercial tools so uh use tool Ling it's for free uh the first stage which should be still standard is of course writing test cases so every project should have test coverage between 80 to 90% if you reach an auditor without having your project fully test covered uh you are wasting

your money basically so uh this is also something that uh that every developer development team can do them themselves and of course it's good to cover not just the happy path scenario but also some kind of like edge cases in the test suite for this of course you need the framework to write and test in and this is something I would say very few developers do but still developers can do it themselves it's about fast testing so fast testing it's a technique basically uh where you uh try all possible inputs on all possible functions in all possible orders uh but the problem is that this is so-called Black Box fuz testing it takes ages because the smart contracts are complex so uh the fuzzer may never finish

fuzzing because there's so many possible combinations so how we approach to fuzzing is that we basically like narrow the space of possible states by guiding the fuzzer um and we call that U flows so basically we we Define for the fuzzer where should it go and where should it not go and by that we are kind of like cutting the space in with our framework but of course there are many other fuzzing Frameworks and uh in the end like running a fuzzer is against the thing that every developer can do himself and then on the top of the iceberg is audit and now uh this is the tool that we have uh created it's called wake framework uh so what is it uh basically

uh this is the logo yeah uh first part is static analysis framework which is something we can compare it to slitter so basically you run it over the code codebase and it returns some findings uh the program Snippets that run the finding that reveal the findings are called detectors and always the problem with detectors is uh to produce as less as possible false positive because then no one uses that second thing we do with weight framework is a testing framework so basically this is the tool where you write your test uh and also we were missing at a bugger I will tell you how we solve this

problem and uh we offer part of the testing framework the fuzzing framework and there is a language that I'll speak about later so this is how it looks when you run the CLI tool over your codebase this is the output and the terminal and this is the static analyzer and here you can see that uh it shows the line of the code where is a possible finding and there's some kind of like severity detection between medium and high and there writes what is the problem so this is something you get completely for free if you run the tool over your code base uh then as I speaking like right now uh it's still kind of hard to debug solid the contracts because there's no debugger uh there is some development in

that but still as we are facing the problem how to debug basically contracts we came up with solution and basically we have transformed the problem uh so we have created this framework that basically takes as the smart contract on the input and creates a model in Python using py types so in the end we are using uh python tooling to debug Sol the smart contracts here you can see this is the python ipdb debugger and it's debugging solidity code so basically uh it's not debugging exactly solidity code but it's debugging the model that was created from the Sol construct one to1 using python P types so with this kind of twist we are able to use the very rich python ecosystem to debug the

solidity contracts and um it's part of the it's part of the tool so you can use it of course for free as well uh the next part we are covering is the fast test thing here you can see how easy it is to write fast test in our framework so in our uh in our implementation the fastest consists of two things one is invariant which is basically a definition of some state that can never happen such as balance of this address should never be below zero if this environment is broken something is wrong and uh then we defend the flow which is the instruction for the fuzzer which functions should it uh fuz and how and by by these tests we are able to

find pretty much uh problems for example in Def Mathematics and this is something like kind of crazy stuff we can do with festing as well uh imagine that you have a for example third party Library uh in solidity that is doing some kind of mathematic calculations you you are using the library in your project uh and of course to audit the library would be extremely costly but still you are relying on the library so you you need to a little bit know if it works or not and we have been solving uh having this problem with um audit of project iore which is a basically huge D5 protocol and our solution was that we have taken the library uh that we are not sure about how it works and we have found an

equivalent library in C language that basically is used for decades and we just wrote a fast test that was uh trying to put the same uh put the same data in both libraries and we are just comparing the output so we we were not really like looking code review of the library we just compare if the outputs of the testing of the Python of the SE C library that was like Battlefield tested and the solid Library are the same and we have discovered that in some Edge case which of course was some kind of like rounding error the sol la is returning different results than the C implemented library and by this approach uh we are able to really effectively

find some problems that would be extremely costly to discover by manual code review and does it work yes it kind of works uh these are the findings that were discovered by our tooling not by manual code review but purely by fast test or by uh or by detectors and you can see that we have hit quite uh quite high profile projects so for example last month we found a medium sity issue in Lio in contracts that were audited many many times before that uh we also have one medium in Accel in high in Brahma so this tooling kind of like is delivering some results and it's in Python so everyone

would tell hey python it must be slow so we have just uh created a benchmark where we have implemented uh 271 uh unit tests of Unis v3e in our framework in wake and we also reimplemented that in ape and brownie just to see uh the compression and we we have run this test suit of 271 tests over these four Frameworks and on three different chains and we are just like measuring the results and we can see that when we use wake with Anvil uh it's getting the fastest results and it's in seconds so it takes the test Su it takes 3 seconds which is like 10 times faster than for example brownie on Anvil so

this is extremely important because when the test Suite is taking too long uh then people will for example drop it from the cicd pipeline so you you don't want to have a test so this is blocking your deployment so it needs to be fast and if we compare like all the open source tools that are in the market you can take a picture if you want there's a table so basically uh there are some tools that are just like for security some are testing Frameworks and our goal was basically to cover cover all these features into one tool and uh we still have time so there's uh more to that uh wake is a c CI tool framework but we also have front end for that that's thanks to language

server protocol which is basically a protocol that allows to communicate from uh developer environments with CI tools or libraries and in our case we have uh implemented an extension for uh vs code which is called tool for solidity so if you just look at the vs Cod Marketplace find this extension and hit install it installs the extension and on the background it also installs wake so it's like one click installation and it's a front end for the framework so what does it offer here you can see for example output of vulnerability detectors and you see it in real time in your development

environment which means you don't have to run any tool over your codebase if you just like happen to have some kind of I know R transay so here you see like in real time that in this contract there is a possible rent transay that's just the output of the uh of the V framework in your vs code and we also highlight which means means uh here you can see again possible Rance on this line and one more cool feature uh we also are able to uh calculate the test coverage so basically uh until your project is green like this you don't have a written test and you can see like

visually which lines of code are covered by test and which are not and if we compare again the extensions over the existing extensions so our Focus was to cover both the security aspects and the development aspect so we believe like our extension because this the newest one uh is is the richest one in Futures but of course there are uh there are the previous extensions that have much more users because they are longer on the on the space but we thanks to the V frame Resturant in background have kind of like advantage that we can also help with security so these are the extensions and if you would like to try W you can uh do it right now uh it's open source it's free and

uh thank you I think we still have time for some possible questions