everybody my name is Jay little I'm a
principal security engineer at ray lab
it's my hobby over this past summer was
trying to sync archive nodes and then
figure out why some contracts have been
self-destructed so I'm gonna quickly go
over like how I did this and then share
the results case anybody needs a brief
refresher of what a self-destruct looks
like imagine like you have some contract
people are using it they're baking
cookies the owners keeping track of who
has what cookies then the owner wants to
close up the shops they do a
self-destruct when they do this the
owner gets all the money collected by
the shop and when this happens the code
and all the storage gets removed from
all the etherium clients on the node so
because of that the self-destruct is a
type of internal transaction so in order
to get this information you need to run
full node with archiving
and these are curated command-line
arguments I found from Stack Overflow
that'll be performance and archiving and
then you wait a few weeks and then you
run into some crashing errors
turns out this summer was a bad time to
try to get a working archived node these
have been fixed but it kind of felt like
I was making a Zen garden out of my
chain data' folder I'd have to like
remove it and start again so I still
wanted to make some results so luckily
ether scan has an API they will give you
a list of all the transactions to a
contract and all the internal
transactions - it took about a few hours
to download ether scan lets you do about
5 queries per second and here are some
results so total there's been about 2
million contracts is created before
block 6 million on main that and of
those 32,000 are empty and a subset of
these empty ones have been self
destructed it's a little hard to tell
the difference between the two so as we
kind of apply somewhere heuristics for
like Oh as is this self destruct
interesting or not like is the account
that caused the self-destruct the
original creator or not or to send money
back to the original but account or some
new one we get down to just 25 total
self destructs
ever that sent more than point one Eve
this was kind of surprising so I started
digging through the results and it turns
out there's a lot of duplicated noise
there's a 10,000 copies of this contract
that kind of read code in a loop and
some Stack Overflow post says this was a
network toss then there's this one's
kind of unfortunate there's been about
6,000 eath lost by people sending some
money to address 0 and then not giving
any data so that's these are gone
forever
then there's about 2000 of these for
their 6000 dolls nulls is just a stop it
doesn't do anything so no contracts
created so it's empty then there's this
thing that's really annoying
there's about 3,000 of these contracts
that just do a push and then a
self-destruct so they just kind of
transfer one or two way and when you
look at it either scan it looks like a
huge mess and it turns out that what
these are doing is they will
self-destruct and then that triggers a
transaction and then it kind of does
like a little bit of a chain reaction
and this was like really annoying to
filter out so we do all this filtering
and we're left with about 2000 contracts
that have been like legitimately
self-destructed that had code and now
they don't and if we like again if we
apply some heuristics there's actually
only like out of the 25 that have 7.1
Eve there's only 16 they've sent more
than one either when they were being
destroyed so for a few of these kind of
highlights of this result this one the
original owner actually destroyed his
contract and sent 50th to zero
rip then this one I got excited because
I'm like 300 even a self-destruct but it
turns out when you look at previous
transactions the owner was intentionally
changed by the original creator so this
probably wasn't attack then the rest of
the results are actually pretty much as
gambling this one had a few ether in it
65 and it had a cool address it begins
with dice so you know it's like a
trustworthy
playing contracts then here's another
one the transferred a few ether this
actually its source code was and a
pretty legit looking website this is a
contract that was attacked and the
attacker called a couple functions and
got a bounty of 0.2 eath I'm actually
the original author of this contract
it's the honeypot with no trap just
honey and I wanted to see if anybody was
scanning binary-only contracts and
attacking them and the answer is yes
this happened about a day after I put
the contract up on main net and for an
example that's not me
here's an old contract it turns out to
be a open source like dungeon style
navigation game but they copy and pasted
some code and removed the only owner
check on mortal so somebody called it
and got three eath so this is just a
quick overview of what I was doing the
summer and it turns out only a small
fraction of contracts have been
destroyed when they had value so I'm
looking for other heuristics to apply
and if you have any questions or are
curious about this kind of analysis I'll
be happy to chat outside and thank you
for your attention
you