[Music]
can you guys hear me okay okay so thank
you for that introduction that was great
I want to start this presentation with a
quick poll so please raise your hand if
you're an
auditor okay nice now raise your hand if
you ever audit an smart cont track
language like solidity stylus Viper or
any other oh nice I see a few hands but
probably not as many as the one who like
raised the hand first and the reason is
because it's not as common as auditing
the smart contracts for sure and to be
honest I haven't found like good
resources to know how to do it
fortunately I had the portunity to audit
these type of code
bases sometimes like a few and I learned
many things and that's basically the
main motivation for today's talk to
share with you some of the things that I
learned okay
so one second we already did it PA
fantastic now let's start by asking
ourselves why do we need to audit the
languages because of
this basically here you can see a bunch
of headlines and one meme that highlight
some of the like incident that happen
because of issues at the language level
right I'm pretty sure you guys remember
from last year what happened with Viper
the re-entrancy guard that basically
like in this case attackers were able to
bypass the guard even though the guards
were like properly implemented within
the contracts like the issue was at the
compiler level right and that causes
many uh losses in Cur Finance what I
want to convey here with this is that
basically those are not ER issues that
are rare those are actually more common
than you might think okay so now I want
to get into the differences between
auditing a smart contract and auditing
the languages behind them right so I
have four key difference that I want to
share with you guys the first one the
focus areas when we're doing on AIT of
an smart contract we tend to look for
logic like business logic flaws right is
normally what we look for when when we
are doing the manual audit but when
we're doing the a review of the language
we tend to see for things like undefined
behaviors features that could be misused
and overall we try to validate that the
design choices of the language are
correct
okay second the complexity of a scope of
course when you're doing an audit of a
language you need to be aware of the
whole
ecosystem a compiler libraries tooling
whereas in smart contracts is mostly
like the contracts and the
dependencies okay third the severity and
risk mitigation
propagation so if you ever find an issue
at the language level is probably
probably going to impact the whole
ecosystem so it's quite important for
you to like mitigate it and it's an
actual like a task that is way difficult
right because you need to reach out to
many stakeholders which is complicated
whereas when you find issues in a
contract it's mostly isolated within the
contract
right okay maintenance
aspect um normally construct are
immutable normally of course if they're
upgradeable that's another case but the
majority are
immutable and on the other hand we have
languages that they basically evolve
constantly so you need to be aware about
the fact that you need to keep track of
both the past and the future of the
language so the mindset of course is way
different so what are the things that we
can look for when we're doing these type
of audits
one example is function identifier
management what I mean by this is that
if you're like checking the dispatcher
of the language you need to make sure
that if for some reason within your
contract you have two functions that
share the same selector or identifier
the compiler must throw one error if if
that's not the case you're basically
will end up with a function that is
going to be unreachable right also try
to ER check if for some reason the
language have something that is
basically custom
selectors this feature is actually like
at least for me not a good feature to
have because it's quite prom for
scammers to create hard to detect scams
and to be honest the benefits of having
this type of issues are not clear to me
okay another thing the storage layout
implementation this
must be consistent and I want to take
into like the meeting one particular
issue that we find in stylus which
basically like they manage The
Inheritance Fields different from
solidity right but the thing is that
they were promoting like you could jump
from a contract that is upgradable that
basically you can have an implementation
right you switch from solid to a stylus
right so they were like pushing these
type of things but as I just mentioned
they managed the uh inherit Fields
different so this is going to mess up
the layout of your contracts okay so
there are many things to look for of
course we cannot go into details because
this is aligning talk but what I did is
that I create this repository which is
basically a checker with everything that
I know about auditing languages right so
I'm pretty sure that it will be valuable
for you guys if you ever need to face
this type of audits so please give it a
look I'm pretty sure that there is still
a lot of room for
improvement ER so please contribute to
it and hopefully you find Value on it
so that's it thank you so much for your
time for your attention and big round of
applause for our speaker if you have
questions I love to hear them check the
repository please and thank you for
doing the the hard work um
questions any
hand hand
okay thank
you yeah uh I'm Z from random
verification and uh I'm very curious
about the language auditing is that
equivalent to compiler
verification not actually but in our
case we had to take like many approaches
because it's not only like languages
that were written from scratch but also
like edsls languages so there are many
types right so in our case we didn't
like audit the compiler for example for
ex stus and neither for Inc because it's
rust right so we validate that the for
example the macros were properly
implemented the wasm was correctly
generated by the code that they written
right but we do not do a formal
verification first we actually first do
the manual review and then we jump into
formal verification that's basically
like the framework that we normally do
thank you fantastic any other question
there is one guy over there let's be
very quick or no we are out of time okay
sorry so please catch up with the
speaker thank you again
bye-bye another round of applause