HackDig : Dig high-quality web security articles for hackers

Good idea, bad design: How the Diamond standard falls short

TL;DR: We audited an implementation of the Diamond standard proposal for contract upgradeability and can’t recommend it in its current form—but see our recommendations and upgrade strategy guidance. We recently audited an implementation of the Diamond standard code, a new upgradeability pattern. It’s a laudable undertaking, but the Diamond proposal and imple
Publish At:2020-10-30 16:55 | Read:182 | Comments:0 | Tags:Blockchain

Using Echidna to test a smart contract library

In this post, we’ll show you how to test your smart contracts with the Echidna fuzzer. In particular, you’ll see how to: Find a bug we discovered during the Set Protocol audit using a variation of differential fuzzing, and Specify and check useful properties for your own smart contract libraries. And we’ll demonstrate how to do all of this using cryt
Publish At:2020-08-17 15:00 | Read:448 | Comments:0 | Tags:Blockchain Fuzzing

Accidentally stepping on a DeFi lego

The initial release of yVault contained logic for computing the price of yUSDC that could be manipulated by an attacker to drain most (if not all) of the pool’s assets. Fortunately, Andre, the developer, reacted incredibly quickly and disabled the faulty code, securing the approximately 400,000 USD held at the time. However, this bug still highlights the ris
Publish At:2020-08-05 08:53 | Read:457 | Comments:0 | Tags:Blockchain Exploits

Enhance Integrated Risk Management Solutions With Modern Technologies

Many business leaders struggle to efficiently respond to risk and compliance needs because of the complex regulatory landscape, ever-evolving risk scenarios and inconsistent internal processes. It’s only been more recently that organizations have embraced enterprise integrated risk management (IRM) tools to overcome a siloed approach of managing risk
Publish At:2020-07-30 15:45 | Read:386 | Comments:0 | Tags:Risk Management Artificial Intelligence (AI) Blockchain cybe

Contract verification made easier

Smart contract authors can now express security properties in the same language they use to write their code (Solidity) and our new tool, manticore-verifier, will automatically verify those invariants. Even better, Echidna and Manticore share the same format for specifying property tests. In other words, smart contract authors can now write one property test
Publish At:2020-07-12 17:22 | Read:871 | Comments:0 | Tags:Blockchain Manticore Symbolic Execution

Upgradeable contracts made safer with Crytic

Upgradeable contracts are not as safe as you think. Architectures for upgradeability can be flawed, locking contracts, losing data, or sabotaging your ability to recover from an incident. Every contract upgrade must be carefully reviewed to avoid catastrophic mistakes. The most common delegatecall proxy comes with drawbacks that we’ve catalogued before. Cryt
Publish At:2020-06-12 11:32 | Read:557 | Comments:0 | Tags:Blockchain Crytic

Breaking the Solidity Compiler with a Fuzzer

Over the last few months, we’ve been fuzzing solc, the standard Solidity smart contract compiler, and we’ve racked up almost 20 (now mostly fixed) new bugs. A few of these are duplicates of existing bugs with slightly different symptoms or triggers, but the vast majority are previously unreported bugs in the compiler. This has been a very successful fuzzing
Publish At:2020-06-05 09:40 | Read:594 | Comments:0 | Tags:Blockchain Compilers Fuzzing

Bug Hunting with Crytic

Crytic, our Github app for discovering smart contract flaws, is kind of a big deal: It detects security issues without human intervention, providing continuous assurance while you work and securing your codebase before deployment. Crytic finds many bugs no other tools can detect, including some that are not widely known. Right now, Crytic has 90+ detectors,
Publish At:2020-05-18 13:08 | Read:551 | Comments:0 | Tags:Blockchain Crytic

Announcing the 1st International Workshop on Smart Contract Analysis

At Trail of Bits we do more than just security audits: We also push the boundaries of research in vulnerability detection tools, regularly present our work in academic conferences, and review interesting papers from other researchers (see our recent Real World Crypto and Financial Crypto recaps). In this spirit, we and Northern Arizona University are
Publish At:2020-05-03 17:57 | Read:1188 | Comments:0 | Tags:Blockchain Conferences Research Practice

An Echidna for all Seasons

TL;DR: We have improved Echidna with tons of new features and enhancements since it was released—and there’s more to come. Two years ago, we open-sourced Echidna, our property-based smart contract fuzzer. Echidna is one of the tools we use most in smart contract assessments. According to our records, Echidna was used in about 35% of our smart contract audits
Publish At:2020-03-30 07:49 | Read:728 | Comments:0 | Tags:Blockchain Fuzzing

Financial Cryptography 2020 Recap

A few weeks ago, we went to the 24th Financial Cryptography (FC) conference and the Workshop on Trusted Smart Contracts (WTSC) workshop, where we presented our work on smart contract bug categorization (see our executive summary), and a poster on Echidna. Although FC is not a blockchain conference, it featured several blockchain-oriented presentations this y
Publish At:2020-03-18 11:19 | Read:765 | Comments:0 | Tags:Blockchain Conferences Paper Review

Our Full Report on the Voatz Mobile Voting Platform

Voatz allows voters to cast their ballots from any geographic location on supported mobile devices. Its mobile voting platform is under increasing public scrutiny for security vulnerabilities that could potentially invalidate an election. The issues are serious enough to attract inquiries from the Department of Homeland Security and Congress. However, there
Publish At:2020-03-13 09:55 | Read:824 | Comments:0 | Tags:Blockchain Press Release

Chrome extension cons cryptocurrency users out of hardware wallet key

byDanny BradburyCryptocurrency security company Ledger has warned users about a rogue Chrome extension that dupes its victims into giving up the keys to their crypto wallets.Cryptocurrency owners need a wallet just like users of regular cash do. Instead of cash, however, crypto wallets hold digital keys – which grant users access to the blockchain addr
Publish At:2020-03-06 08:12 | Read:912 | Comments:0 | Tags:Cryptocurrency Security threats Blockchain chrome Chrome ext

Manticore discovers the ENS bug

The Ethereum Name Service (ENS) contract recently suffered from a critical bug that prompted a security advisory and a migration to a new contract (CVE-2020-5232). ENS allows users to associate online resources with human-readable names. As you might expect, it allows you to transfer and sell domain names. Figure 1: Sam Sun (samczsun) discovered a critical v
Publish At:2020-03-03 16:49 | Read:812 | Comments:0 | Tags:Blockchain Exploits Manticore Symbolic Execution

Mainnet360: joint economic and security reviews with Prysm Group

On Monday, October 28th at the Crypto Economics Security Conference, Trail of Bits announced a new joint offering with Prysm Group: Mainnet360. Carefully designed to produce a comprehensive assessment of the security and economic elements of blockchain software, Mainnet360 gives teams a broader perspective that will allow them to build safer and more resilie
Publish At:2019-12-09 09:30 | Read:1382 | Comments:0 | Tags:Blockchain Press Release

Tools