[Applause]
this is presentations at all I guess I
don't attack how it happened to how to
make themself
it's an overview of gas exploit changes
that happen last year it relies on a
concept called Gaston canvas this
concept is too hard to get into in five
minutes but what it basically is is the
ability to refund yourself on the
etherium devil if it's built into
aetherium and it's effectively in your
seat 20 that pays for your gas so give
it that context you'll be able to
understand the rest of the song and then
so they attacked given that token is the
next point whereby anyone who pays for a
transaction fee can be to be attacked by
minting gas token for you so in this
example exchanges who paid for your
withdrawal fees which is all the changes
in this case if you withdraw if you make
a withdrawal from an exchange into a
contract that you created that has this
exploit iment what ends up happening is
the exchange mints gas token for you so
what that means is they pay a very high
gas limit in the transaction for your
withdraw of a very small amount of heat
and what that does is it prints you of
gas token that that allows you to drop
it from their pain for the withdrawal
fee so in some extreme cases exchanges
pay up to $50 for you to withdrawal from
their account and effectively you're
making $50 so that was the premise of
what happened last year and when it
happened
if every exchange was affected to
varying degrees of severity and in Who
am I
co-founder of the gas second attack if
you audit with zero trust and we have a
wallet company called off period one
question that I always get with this
asked is gasps token good the basic idea
is good it says if you want to clear
some estate on the etherium network will
give you a refund for doing so to make
the state smaller but what's happened in
reality is a lot of people are using it
maliciously so people are printing a
smoking now with the intention of using
it later and if that's not how it was
intended to be used but it is how it is
being is now I mean how are people using
s a lot of people are using it for
arbitrage so when they go to make a
trade or an arbitrage whereas anyone in
this room will be able to make $1
someone using gas soap you might be able
to make a dollar and ten cents because
they're there and their fees are reduced
because they have Denisovans exchanges
can use this has effectively unguessed
futures but that's a little longer
conversation accent here's one example
transaction you can look at later in the
only really important part is this isn't
a control for an exchange and you can
see here the transaction fee is point
two either so this is basically saying
that an exchange
they point to ether in order for me and
which are all point O one evening for my
exchange account so that 34 dollars at
the time came from living change and so
it's a very real attack how can you
change this fix this the answer is don't
pay for a user's gas more practical
answer is a charge of withdrawal feet
that's greater than would be of the fee
that the user can Minden yes okay so so
someone like point base charges $5 order
withdrawal fee the user who wants to
withdrawal print Gaston games can only
be able to print lesson and it wouldn't
make economic sense a few examples of
interfaces that don't turn an abstract
with gas but if someone painters our
trust wallet what makes it mathematic
you'll see here they don't even mention
gas but if you use one of these wallets
to send money to someone or said when
you do a contract what might happen is
that contract might be trying to save
gas from you you almost won't even be
able to recognize that you're being
attacked so it is pretty dangerous
there's just something I walked out for
and then I'm running out of time here
but but real could be some interesting
facts
these guys and so so some interesting
facts about gas as everyone knows the
gas prices currently rising those two
graphs show it what's seen here it's
that miners are actually now using gas
token that blocks some of the blocks
they mind their only minting Gaston so
if you look here they're not collecting
any fees all these transactions are
straight from the straight there are
miners transactions they're not paying
any fees and they're just using the
whole block a mind to print gas token
and it's pretty crazy that's not how it
was meant to be used but but we're
seeing it happen in the real world
here's the use of gas token rising over
time the same things happening on these
classic nothing's any better
and finally that there are markets for
gas token so people are starting to
trade gas token as in the air see 20
token and not as the gas refund it was
meant to be so the point of this talk
was to kind of show you what gas token
wasn't to make you aware of it and how
to protect yourself so if you're
vulnerable thank you
[Applause]
you