[Applause]
everyone this is the workshop there are
more people here but I'm trying
Dean John we are but a constant
diligence we do small contracts acuity
and fidelity if you have any
consultation or you want to work on
downs
you can go to a website with all the
excitement no more and also which is
totally everyone and see if your code
has like their common mistakes or not so
there is a game that we do this quick
intro go through that high-level
introduction to eat alone just to know
you're in the same space and you go
through some of the tools we have the
premix some of the plans that you can
start playing around with eating and
more details on how eating works or the
memory words didn't want you to make it
easier for you to actually get through
these challenges and also some of their
capitalize or CPS and we have a few
challenges at the end that we try to
advocate you are walking to our to our
workshop is a desk from proper setups so
we're gonna just read everything one
hour and probably do more question are
saying traffic
so according to your background nice job
talk about diversity
and so like where which with legasus
from the area the group here likes
everybody tritanus her contract at some
point more or less do you feel like we
understand like you understand what the
state looks like and like blogs and
codes and things like that okay although
super fast is a big find great but it's
good to review and somebody probably
didn't want to admit that they don't
know it so okay so but here what is it
here iam your even is like it's all
these accounts they have these four
properties every single account has
announced a balance code may be heavy it
and a mazy storage so the state is made
up of this great big list of accounts
there are contract accounts and external
accounts sternal accounts don't have
code don't have storage there's op codes
to things and the VM there you go yes
this is useful to be
this stuff in the context is like
security that there are these these two
types of transactions you can just send
money or send eath from one externally
own account POA to another or you can
send me contracted with magic happens
when you send you to another track
send this transaction the contract can
do like any other sort of internal
transactions message calls sometimes all
this creates a state-transition
contracts can call each other and this
is like it gets worse right like I've
heard recently that we're had like there
are you know the average call theft on
the main net is like at like getting
deeper all the time and contracts are
more like increasing composability if
someone we stop saying interoperability
2.0 hooks Interop away and now we say
composability I just figured that out
but and so so this composability is
creating a lot more complexity things
are having
deeply in the call stack and that
interesting implications and a lot about
can everybody hear me at the back to do
I need to projector more okay gasps I
mean there's guests you all but a lot
gasps limit that's really important
actually gasses who here subscribe to my
newsletter were aliens smart contract
security newsletter right so I can't
stop talking about like I want to do a
newsletter that's not about gas but it's
the most interesting thing to be real
right now so the block cast limit that
can get you in a lot of trouble if you
run out of all the possible gas that and
you might eleven give you and then if
you're opcodes just change in price and
you were counting on them not doing that
sorry there's a table of opcodes with
gas prices
I made these slots there are a few
things there that one was like for the
gas price yeah so if you increase that's
why seven but one way - with my nothing
yeah and prioritize that over the other
one so you can drop down and get ahead
of the transaction we're just increasing
the gas price with one way or the fact
that that blocks are the limit is that
because Bluffs are limited or scars so
you can do some cryptic honors plays or
like some attacks based on that it was
it just over all things
programming is if you want to talk front
right go deep on that sock
[Applause]
and there's a lucky duck tomorrow at
4:00 but nothing rather overall funding
taxonomy so so as I said this was
supposed to be a more hands-on workshop
but you're gonna be I'm going to be
hands-on and he can also follow you by
HSN so you can go to this link there's
also on the white board if you go to
this thing
[Music]
they're going to see this just here it's
supportive challenges yeah a fun
challenge be fun challenge one you can
see a challenge here like this if these
are not challenges I just want to make
sure we are on the same level before
that one big thing I do
just to know exactly when you're gonna
be on the same level but this is
solidity or guests step on here I'm here
beside the source already but it doesn't
do anything special here it just have a
radical game owner and just when you say
high pitch and 70 puts the name in the
name and its high think nothing for your
specialty so there's a few things I want
you to know what is like but this is
like that things are public is that if
you go to Rob's pen which is in here
it's kind of Austin as you can see the
transformation of blockchain and what is
happening so let's say you want to store
a value
so give me ahead of yourself
I'm going to the end here so you wanna
start value and love change tournaments
or secrets or anything you won't know
that but you might not know how that
works and what that means so a lot of
times in smoke on charter the family
starts at here so it's called slot 0 so
what I can see that you can actually see
the memory the memory stored so we can
actually go here and it's a beauty of
NSE the memory that that thing that
constructor with you is so you can
actually read the text that was passed
to the contract through these day guys
they have gibberish - but they stayed up
here - so I'm working on this other tool
called Regents for now my child is
really better on send the link on
Twitter like there aren't but this is
something to be able to like easily poke
around you know even small contracts so
like in this case I just want to show
you that what I mean by nice so let's
say this is smart this is my contract I
just copy the address and so everyone is
too
[Music]
so the school has like nice interface
and he tells interlock all the
information that there is so in this
case what we need is to connect to a
node which is now I use Austin and I
think you brought us to a user on node
or connect to any known but you call
this kind of maintenance trying to test
it to just be able to write great things
so if you see a bunch of options like so
this tool you can check it out later is
not important you're just going to show
you how to restore it like in this case
someone reads
and when you do query you can read the
balance details of a block both of this
much on track its storage so in this
case I want to be the soil or at least
address that I just copied so imagine
that you have a secret in that small car
track so when I click it goes query the
first 10 storage there so this is what's
smart contracts of the PMC's but this
tool also charged to like cast at the
scene so it reads the first 10 storage
and you can see that even though that
store should not be visible from outside
I mean they subtraction software
development it is so we can read hello
there front here there are other tools
you can use destroy the set is not part
of this works unnecessarily but for a
plate if you wanna add function trees
fortunately it's like perfect and as I
said that I really like this for the
canal I am nice
so anything back to every mirror yet if
you go to this link that that link
kicked up taeho you're gonna have go
through a bunch of challenges
one is is challenge one that if you look
instantly simple we has it balance that
you look open the ballast he has a ten
you can find and whether you pass on if
you have to balance and there whatever
that yeah the specified it's got a berry
you can see any way to have infinite
balance here
[Music]
yeah
do you want your trip normals now do you
want to then showcase Oh easier
there is a so you make this is how a
code editor finds a spot and go through
the code fine what do that is there are
some tools so it's a dimension that
makes it easier to move Barney's comment
box
come on so yeah people here use remix
anyone remix - grapes so one of the
great things that you've been working on
completely it's as a effects platform
which is a security of the service tool
a little bit like you throw some our
contracts at it and then it goes back a
bunch of bugs of you so like it's pretty
great another awesome thing because it's
built right into remix so if you do
plugins things like the thanks goes up
you activate one and as it turns out if
you load it in challenge one Williams
with the expanding at the analyze button
the screenshot has already set up it's
all anyway so yeah so you see you at the
Ln button and it spits up the agent of
the bottom you something
super convenient super neat good way to
cheat on workshops yes very cool yeah
also if you create an account on the
next i/o you'll have a point for
assistance
if you just do this again with remix is
it doesn't but kind of like a sample
address and it goes away in regression
but if you dream here on the account you
can suddenly account with your
credentials and that's kind of also if
you want to pay money it's a freemium
service so link you don't have to pay
money but if you do take you get much
universe standard like we have large
contracts and actually put a long time
on like goes a lot degrees
it's great do that
there's also these command-line tools at
your great saver of index JavaScript
stuff that's CLI and you like Python
stuff they both have like the truffle
immigration that's pretty good
other other goodness
[Music]
so this is manual for more at someone
but a variety drops and Tesla and I
think and you they go to the faucet
Alaska IO or me or I can just send it to
you right now just like what he was
saying so here like let's say for this
challenge
mythix is here that when I install it to
and logins kinetics is here you can just
press analyze and actually looks for you
and spines all the issues on the air it
says I can overcome even though that if
you keep picking up your ransom message
as value so that if someone forces send
that much money to overflow which is
less real estate but this one is a
mountains using inclusive and easy on
them flow as you said and
[Music]
all right so we talked some peas but gas
runs out for any reason to function call
three bears and the whole state change
doesn't happen anymore
there are followed by functions that
will be invoked if you just don't
mention any function names or you
mention a functioning that doesn't exist
so that that has been there for some of
the attacks that way the transaction
does not exist for rather part of that
function so it's documentation is the
best place to look at we going to do
some other ones too
so this is Mary add myself so I won't
talk about that warehouse storage is
stored and I already talked about these
regions which this is a link if you want
to download and look at already show
that you but there is also this blog
post from one of our colleagues if you
just the link was long so it's the best
way to find it if you google and
understanding you to your contract
storage and click on this program the
blocks are in tough problems that's this
is a boot block those there are
different patterns of people at the
carries 40 different things and if you
have any questions there just hit also
had a just in the off their works text
so the other challenge we just talked
about the conscious tour all not to
store secrets right there on this so in
the traditional main the best way to
store smoke so passports is a passionate
right so you can pass a password in
solitude is a check so you can just hash
save the kitchen and use that so it
seems like a good way right if anyone
looks at the very well they still cannot
guess what the password is but you
depends on how you store that so
everything on if there is data means in
your public so in this case
[Music]
and this Casey to go unchallenged to
slipping up to USC
[Music]
so this is a simple look for people that
have done so this might be too simple
but so this is just contract again it's
the password safe the password and then
you're on you can guess the password and
gets the mining happens project so in
this case let you might say that anyone
sending it gets password transactions
you can see the password everybody but
even before app we can just at the same
way as you do in training before go to
Roxanne and I just see the password and
that's as easy as it gets like so the
constructal can go there and look this
is a transaction we did for another
conference
yes it simple not Sigma then you can see
they come to contact there so it's the
easiest way even still do tools and we
filled with some other ways all right so
[Music]
the only thing that ever gets confused
about that is an inch of your randomness
so we can have can get some applications
that you might need up randomness for
[Music]
again or in order yet
down there's a lot of use and promotion
of blockchain has been on these kind of
applications too
we don't see this much these names like
that so you can really get randomness
because early on people start to use
different aspects even timestamp for the
randomness but all those people can
guess for it so they were very like what
I'm just trying to use some of the
things are not known before like the
blood patch or the catch the boat ashore
that some other a variation of that so
let's see if that works or not so we
have this other challenge vanished B
which basically this facility just want
if they will be there so you have to
pass a number and put somebody in there
because graphic a lottery ticket and
this part is using the hash of the last
block and in cash that and attention
number and if your guess is the same as
the number it transfers you this much of
it so it seems to me like you randomly
wouldn't know but how would you guess
that so how would you make this worth
nothing I would write
like in order to attack this contract
you have to try to contract employee
continent and use that contract not
Agnes contract so you go to the same you
run your code the same environment that
this code is running at the same time so
here you notice my practice doctor right
yeah do we actually have to write the
first mantra since this is looking at
the previous block you could just look
if that wins the lottery and then a
sentence reduction with a high playing
basically get understand that that's
possible you check risking because
there's 15 seconds long so if you missed
applause you miss that 92 7 Action
Comics you can try to get in but you've
seen attacks that's people selected
thousand translation just to make sure
they kept in but that means for this one
compostela matter if you look at the
appointees of the current block
you'd have to brute-force this person
in the previous block there's yeah but
that's the race
[Music]
yeah there's no comparison - yeah yeah
so that's why it's so let me say this
practice together here so I'm cheating I
have two conferences over here just to
stay home
yes so well what do you what you do is
[Music]
so one thing is that you don't need to
oppose having full function here and
just about the enterprise but this is
easier for now for us and as I said this
was supposed to be something you saw but
I just saw it here so what you do what
you have to do is
[Music]
and
[Music]
the devil tiny moment
[Music]
so now in this case what I need to do is
deploy this before this transaction
there's this much ether so what I got to
do is just complete this transaction so
it's this contract so I know why it is
what is that I have a function one trick
is to changes to constructor so you're
not deploy and call the function again
so in this case you have to deploy these
parts in this contract call attack with
the input of the target which is the
target sadness and your kind some value
in there so what it does is talk in
called targets lottery function which is
this function with some value which is
the message of value this value is how
much money of such a capacitor and the
number that this contract is calculating
here as well
so if the number is the same it says
that one easy way to make it more
ethically good hack is itself unstrap
self-destruct so you get the money back
and be clear that water will here be
compiled
and just put that piece over using metal
mask here just making sure about the
technical maintenance
[Music]
yeah
I said all that
we have sent their souls right
it was my time fighting the family's
excitement and
this constructional input in the name
that state employee the right one
[Music]
did it not scripted he would come at the
phone before the service I can construct
the keyword comment and for error
[Music]
three juggling balls whoever yet get
typos oh yeah
yep alright so the address was it seven
FTP port sometimes actually so news
price economist who deployed BAM but
this time
and don't you forgot to folder
sorry
so it's not have to serve a new message
a sentence mr. send it back - oh no what
oh yeah over who has said who's hanging
with a common target the visitor center
mr. centers as me away
[Music]
but bloated sense oh right the sense and
any value yes all right let's try this
again just pitiful bit the problem was
so here is this contract accepting us to
send some money this time now we didn't
have anyone yet attach the strap back
so that's why I fashionable tale so send
another transaction now yes so I can see
you transferred what weight is happiness
and he said to us this is at 13:37 bay
but it's not scientifically so one the
current one is unchecked except
discharge after that so in order to see
it much better maybe this is a weather
vane
so I especially density yes
it said one way got this much either
setting back to the message just send
there and self-destruct alright so one
of my main point of this was to say that
you can attack the contract we take out
of the contract because you get to save
environment I think it's using the same
I'm saying environment variables
everything that that what the contract
has access to is there any questions or
comments about test the debugging was
fine all right so this is like similar
example but likenesses so that we need
to contact technology contract so it
goes back to the cow story and everyone
here knows about our know what you
learned about them from that connection
so the Dow's Asik and you know the
relation between velocity and up it
started from that and it would say so
attack patterns
they must lawyer because I think I'm
Rachel bye but yeah I'm going too fast
[Music]
so yeah so then down as I came in he was
like there's two lines of code - yeah
Phoenix is the other way around so here
you can see that the value is fine then
[Music]
so is this gas left can say how much gas
is left before they have to do another
map there to see person to another fault
or not there is not a way to say if the
balance of it but if this balance here
if this balance is how much left here
check - you have to have a exit
condition there because you can be you
want square root of two thousand itself
and if you know sort of gas as I said we
believe it so you use all the balances
that you try to run it there
so as you said at the end 180 million
dollars or something that were stolen
with these two lights to the underground
that's what makes like the safety
unspoken I read apartments this seems
fine but it should be at the other day
on that visit pattern that's a check of
that experimental interaction so we can
check check a new get picked on negative
interactions or deals in the other so
for this you don't try to do it mean to
step back and steal money from this
charity for education so the content you
have here is pretty simple
the other man think that is a really
common pattern another Pro tems
contracts and other contracts so we have
this entire pound vacuum balances that
holds the balances there's an event that
doesn't matter
constructors should request to have one
either in there they ask that when he
gets the message has entered Center
balance so anyone can donate its payable
if you can do it through their own
balance the direct society they get the
balance can take your balance and you
can be drawn as you can see it's using
the same pattern as the same time as the
down so it checks the balance it sends
that out and if you succeed this is a
convenient work for that without it
certified if just any set contact means
an event and it uses the Ducks the
balance so you want to attack this I
want to make it more exactly but as
possible but exactly forgot to show you
the solution and so the rest we like to
do this like that starts working
together for the Tollison is and how
would you what would we have stopped
condition here if you want have activity
to attack I will try to like what stops
you smaller than my balance so you want
to get more than half of the time
[Music]
nothing is left my call will fail
because it runs out of balance before
that happens we need your balance just
you tell yours just letting your balance
my addresses bigger than the total
balance of that just means like a kiss
blonde and the total balance is 100
or say he has like zero by actually I'm
just gonna quote here
so this is like basically equivalent of
using cyborg clothes what are things
just coffee cold and ice in fact making
exam so here it exactly the attract here
we are using the Constructors but it's
easier here to do but then you can
thanks so here you have to let donate
first also have it balanced in that
charity to be able to attack because if
you know it's really calling power we
draw in checks if you have a balanced
effector or not so the first step is to
do that fans say question we passed 20
letters which is the challenge we need
to have them in the same place and then
we donate the message that value that
passed this and the deployment and then
they there after that you have to call
attack so I'm going to just deploy it
and then one walking with us with you
[Music]
show you here that there's a balance
here the baby's much balance there
[Music]
all right so
I would say this China
exactly so event with any value years it
doesn't matter
like right here folks again
[Music]
all right so it's just boys fine
so they're after this mind what it does
is like it sends whatever you send us to
today the charity and as you can see it
created this a contract and sent any way
to our charity so it we even here you
should see that we have the balance for
that contract if you want to check
there's also this easy way to change
[Music]
this easily to check a lot of things
here you can use challenge for which is
the charity charity that's not a dress
you have to deployed it and you can just
give access to access to the
functionality that there is so now you
can check the balance of the response
contract which is
you can check the balance and it is 10
as you said 10 way of airplane
you see some things have a margin see it
should there's a practice and then we
can experiment with them so so here you
look at the code it's the same apart as
we talked about so if you call attack
attack you spend involved we draw with
the total balance of that address and
it's going to send that ball back expand
get that ball back
I mean to each other and call the ball
back and address this that this colleges
is more than one either you would try
again so I guess to send some points
that are dispersed it's already done
that wouldn't want it there
[Music]
there's a sadness to make sure our
[Music]
so let's try this because that everybody
trying to take succeed in tech - so
there's no input the very positive are
shocked at the target you just call
attack
[Music]
we want to say I did that I did send
that was prophesied to go
[Music]
and it's like I guess you've got the old
part that I was really learning about
this now but and see that is if they if
that like is successful it should learn
something like this
[Music]
or that is the right to come back
[Music]
and I wanted a work
yeah it's a work but this is the
transaction we sent out internally to
artists and we confuse myself again
[Music]
when I start there's something cool and
it started me facing it
we take both of the sense of depth and
esoteric there's an opportunity check
just Chancellors that's the target bass
has been more money pair and the problem
here is our money so it has to be so if
you want to do the community service
check and we did it gasps gasps laughs
it's the first time in ten to twenty
three hundred twenty orders for a
transfer increase the gas left and
returned at don't continue something
like this with works also as well but
what can excite pleased to see how many
things will find us and this one is an
original one so it's a bit distracted
transit a contract that is wonderful so
we can buy matrix here charge for
analyzed
are you these artists are you locked in
I think I bet that you have that moment
sighs yeah
[Music]
I learned this trick from rain nice not
joining your endless explaining that I
get but it's like to be what what
questions people have insecurities with
anxieties do people have no like writing
smart contracts like for the poetry
experts what did you really get out of
this anybody and be like deploy to
contract to maintain
like whatever yeah how'd that feel
I had my way I guess my denim indefinite
so it was super fast took like three
seconds or something and it cost me $200
right $200 is like minimize the time oh
you guys guys that contract went super
famous Mike better than that and this is
this is your Chris from a maker to
separate yes yeah this is the first one
my first time I I had from well
personally I'd never do play anything of
consequence in maintenance
my stuff but I've never liked what
anything that like matters a lot so I
like that
yeah
[Music]
hop away - yes
and calculation is the same way
ever late had a contract act when you
were like lost money in some you know
the many ways that you can lose money in
this world yes I may know what do you
know you're ready
[Music]
[Applause]
done all you can't write there's a point
of diminishing return when like there's
just no there were like you know I don't
think your o'clock post--and like you
can't do anything you can't even see
your own typos
so you get somebody else to do it that's
us you're prepared you're like well
prepared a blog post about Aaron Chris
mark contract audit great way but yeah
so like there's a lot of things you can
do to not get a very good result from an
audit by just like dropping a code with
no documentation on us or you can like
do do your work internally up front to
be really ready for it come to us like
well in advance maybe maybe we decide
that the best thing to do is
work with you for a few days just to
like give you like hey like fix this fix
this delete this and then like I'm in a
better audience like you know be able to
focus just on like going deeper and I
think that's like that's like the being
well-prepared front on it can make like
an audit more affordable effective for
most people and I think like most even
smaller teams that like our maker can
afford to like write documentation if
they're willing to take the time to do
it
usually if you write good documentation
or specs for your code link you sure you
just hacked up the codes maybe you wrote
tests first in which case you're a link
between grades where the curve but then
if you like sitting you're like try to
communicate in prose like just plain
English to someone else what your code
does you have to read it that guarantee
you'll find like something you like be
like what week does it actually do that
thing when this happens and you'll read
it again you like oh no it actually does
something I do not think it does
that's as waiters I highly recommend it
yeah invited and writing in like
comments and documentation and one
overall what this have to do is sickness
that the manual I explained you can see
the line that was cold kind of comments
like is it what I'm saying if they
should do that helps a lot like we don't
need to be graphs and charts letters
like that apparently was so good action
salts so we have free
progression and with entrances actually
limited to the premium version it very
sadly deputies these two things that are
most relevant for anything so whenever
you make a low-level call my cute
concretely and the DDM gets all the gas
is still left execute that I Connor its
home and if you do that
that you should never change the world
state possibilities because their
contracts and trusted that this change
might never happen because they had a
clunker can be ended
so let's to see be warned about these
new things and if you move this time all
termination is fixed and the variance
will be detected as time already
[Music]
- CTF style things sweeter and of the
few inches and equality in every buying
reading an audit reports you can find
all our blog post audit reports control
on our public of their villages see the
bottle bounce or the WebEx and they're
all there and economic - - is that so
thank you for being here like stickers
and
[Applause]