[Applause]
[Music]
ok number one I think I do and I am a
researcher from the officer I am
watching every circuits - and I will be
talking about risk for finding a LAN or
even seeing a smart conference it's a
company we do by our contract you might
want to do a validation procedure for
example you can write a group of test
cases to test whether your contract
gross enough or you can use a
verification tool to verify whether a
specific property close enough or you
can find an auditing team to send you a
contract to them and get their feedback
after that hopefully you can get useful
feedback and optimize your smart
contracts and you can put them on the
blockchain but in some cases those
valuations might not be able to work for
example if there are a lot of large
corporates of auditing requests requests
you might it might take a while for you
to get feedback from an audit team or if
something new some some new problems
just come out in your application and
testing - all have not been updated yet
they might not be able to give you a
good detection so if you look at this
CBE sample which was reported last year
and you may find that this very simple
integer will flow might be able to cause
a zero pain
transfer in this transfer proxy function
and it was happening in many other token
concepts last year and when we used some
existing analyzers to analyze this
security issue away they told us that
nothing's nothing was found
so which was obviously for snacking in
this setting so the reason for this is
that some of the analyzers when they see
and overflow they they were not directly
recording instead
they will check whether this integer
rules will be followed by a lesson with
River operation if so they might
consider this as a protection mechanism
such like the safe math library and this
one does is just not this case so what
we are trying to do is that when you
have your contract we would like to know
whether there your contract can be
matched to some existing knowing
security issues and instead of directly
and illogical so you can also do this
for those contracts which are already
deployed on the blockchain and to this
end we are exploiting the idea of
kok-long detection technique
specifically we are generate a birthmark
representation for the vulnerable
contacts or the database itself and you
do the same for your contacts and we
analyze the semantics of them and you do
a sort of cross matching algorithm and
identify whether they are semantically
similar to each other and given the
concept we create the control flow
graphs for the contract and we perform
supporting execution on the graph itself
and we refine the graph on the fight to
make it as complete as possible and for
each basic block in the control flow
graph we are we first we abstract the
past additions to resemble and secondly
we analyze the dependency patterns in
the block for example we will check
which storage arrival was first update
it how did it in the block and then used
as that's a premier of a message home
operation and such dependency panel will
help us better understand the behavior
of this block itself and also the whole
contract as well and then we got a
numerical
label control flow graph and then we we
can do this at a constant level or a
functionable
and that's given to the pair of contract
robots where your first compute their
vector numeral vector distance and then
we are adopting women adopt the similar
similarity by construction ideas - I can
calculate how and what probability is -
contracts or functions can be cemented
clones or to each other and we have also
deduct this in chrome toward who to
implement to implement this idea and we
have done a bit of preliminary
evaluation and it turns out the evil
troll can manage to deliver better
detection capability than paid based on
approach with omake considers the
syntactic information in the concept and
that will conclude my talk and if you
have a are interested in more details
you can refer to this to move of the
epidemic papers ending in addition to a
smart fantastic theory we also into
other interesting things including rat
attack or other security rules on our
project and we tell you to know any
[Applause]