00:00:00.333-->00:00:05.125 >> Um, so back in February basically, I wrote er a decompiler because everybody was 00:00:05.125-->00:00:09.625 talking about ethereum. Ah, I wish I’d bought, er, coins instead. I would have made more 00:00:09.625-->00:00:16.250 money out of it. So, just to give you a quick introduction, um, if you don’t follow me 00:00:16.250-->00:00:21.750 already on Twitter this is my handle, I’m also the organizer for a conference in Dubai. I 00:00:21.750-->00:00:27.792 didn’t come to Vegas since 2011. I took a Vegas break. No, it’s okay I’m fine coming back again. 00:00:27.792-->00:00:32.792 Um, and my new claim to fame is to have been called a ‘fun guy’ by er the ShadowBrokers. 00:00:35.917-->00:00:40.917 So [laughs] so just so you know er, I won’t be talking about what, like blockchain is, Merkle 00:00:47.083-->00:00:52.083 Trees is um, er all those things and er we’re going to focus on Smart - Contracts, er how to 00:00:55.000-->00:01:00.542 decompile them as er Windows reverse engineering. I thought it was interesting to analyze 00:01:00.542-->00:01:06.500 like the er VM itself. And um, I’m also using a tool which is going to be open source, so, I’m 00:01:06.500-->00:01:12.583 going to give the link at the end, and er, yeah, and of course the tool is not perfect so 00:01:12.583-->00:01:17.583 you’re more than welcome to contribute and er and give like pull request. Um, just like a 00:01:19.708-->00:01:24.125 short overview of what we are going to be talking about today. We going to be talking about the 00:01:24.125-->00:01:29.125 EVM, its memory management, ah, or we can do like type discovery which er is important, er 00:01:31.833-->00:01:36.833 especially with er many like static analyzers but also like if you’re building a decompiler 00:01:36.833-->00:01:41.833 obviously or, it can be used for like static and dynamic analysis, um and the known type 00:01:44.708-->00:01:49.708 of er class of bugs we know of so far, and what to expect in the future. So, how many of you 00:01:55.167-->00:02:00.167 are familiar with er Solidity, er please raise your hand. So, basically er, Solidity is er the 00:02:04.833-->00:02:09.833 decompiler for Ethereum so the way Ethereum works is like to execute the Smart-Contracts is 00:02:13.375-->00:02:18.375 basically like a software layer on top of the blockchain. So as a user compiler of Solidity 00:02:20.542-->00:02:26.000 which is translating er code which is er written in a JavaScript like format into 00:02:26.000-->00:02:31.000 bytecode. Um, and Porosity’s the tool I’m going to be describing today and releasing. Um, so, if 00:02:34.208-->00:02:39.792 you’re familiar with like chemistry and physics, it is the exact opposite of solidity. Um, 00:02:39.792-->00:02:44.792 hence um the name. So, so far like there is a lot of high counts on Ethereum, there’s like 00:02:48.917-->00:02:54.125 millions of them and if you look at the actual number of er contract accounts, er it’s 00:02:54.125-->00:02:58.667 almost one million - probably it’s like one million by now. But the actual number of 00:02:58.667-->00:03:03.667 verified contract is very small. And the definition of er, what’s a verified contract is very 00:03:06.958-->00:03:11.958 obscure, um but basically it comes down to if the source code is provided, um so when it comes 00:03:14.250-->00:03:17.833 down to reverse engineering, like usually don’t care if you have the source or not, but it’s 00:03:17.833-->00:03:22.833 interesting that since this software layer has been introduced with Ethereum ah, we 00:03:22.833-->00:03:29.417 see like a need for reverse engineering. Um, and especially since Ethereum introduce a 00:03:29.417-->00:03:35.458 concept of ICO, to leverage the use cases for Smart-Contracts we’ve heard a lot of stories 00:03:35.458-->00:03:40.500 since the beginning of the month. I think here I’m mentioning like two, but I think 00:03:40.500-->00:03:45.500 three different stories happened this month, including er, one with er CoinDash. Er, which is 00:03:48.125-->00:03:53.375 like the first one. Someone changed like the address where it received the funds and most 00:03:53.375-->00:03:58.375 recently, er Parity which is a project, um, started by um, one of the key developer of 00:04:01.583-->00:04:06.583 Ethereum. Er, at a vulnerability with one of their Smart-Contract and thirty million got lost and 00:04:08.625-->00:04:13.625 few days back something happened with, I don’t know, their ICO and ten million vanished. Um, so 00:04:16.125-->00:04:22.583 that’s basically what happened when you like writing software to store money but don’t have 00:04:22.583-->00:04:27.583 proper security checks. Um, small damaging then a blue screen of death, it’s like a 00:04:30.250-->00:04:35.250 wallet of death. But er, so, the EVM, so the Ethereum Virtual Machine, um so for like each, um 00:04:40.708-->00:04:46.458 like you have three concepts: Accounts, contracts and blockchain which are 00:04:46.458-->00:04:51.458 interchangeable. Um, even like for a person like me the difference is like quite obscure 00:04:53.500-->00:04:59.000 but I’m mainly focus on the actual bytecode which is stored on the actual blockchain, so a 00:04:59.000-->00:05:04.000 Smart-Contract it is basically a synonym, in more fancy word for bytecode. And it’s stored inside 00:05:06.083-->00:05:13.000 the blockchain and um it uses (one sixty) 160-bits addresses and addresses correspond to an 00:05:13.000-->00:05:18.000 account. And one of the specificity or so of the Ethereum virtual machine is that 00:05:20.917-->00:05:25.917 use like (two fifty six) 256-bits registers. Um, but they don’t really have like registers 00:05:26.708-->00:05:32.125 like you would know in traditional infrastructures, like F eight six for instance, 00:05:32.125-->00:05:36.583 so I like this concept of virtual stack. Um, the more you look at it, the more you see 00:05:36.583-->00:05:41.542 like it was kind of their trying out different things, still like the outcome is pretty good, but 00:05:41.542-->00:05:46.292 if you going to be like, going to be like a virtual machine, you know, a lot of the things 00:05:46.292-->00:05:52.458 are a bit, er, a bit shaky. Um, so for those who are not familiar with Solidity, it’s 00:05:52.458-->00:06:00.208 basically what it looks like um, on the left that’s a simple like, um coin contract so it’s 00:06:00.208-->00:06:06.625 very simple, usually you have few returns, some storage memory, um and even like the 00:06:06.625-->00:06:12.083 instructions themselves um are like quite straightforward. You do like many, um, you store like 00:06:12.083-->00:06:20.667 um, an integer, you do subtraction, addition er, that’s pretty much it. So, er like the 00:06:20.667-->00:06:26.250 level of complexity of a contract is um, very far away from the complexity of a kernel 00:06:26.250-->00:06:32.000 driver, per se. Um, then you compile it using Solidity and then you get like all that 00:06:32.000-->00:06:36.625 bytecode, which is going to end up on the er actual, er, blockchain. And at the same time 00:06:36.625-->00:06:44.167 you compile, it also saves the um, interface which is going to be used for like um, all the 00:06:44.167-->00:06:53.167 Smart-Contracts to like to call that, er, specific contract. So, we’re getting the memory 00:06:53.167-->00:07:01.208 management. So you’d have like three different type of memory, um that are significant. So the 00:07:01.208-->00:07:08.917 first one is the the stacks that I was mentioning before, um like under traditional architecture 00:07:08.917-->00:07:14.458 you would use like the stack to push arguments, at least with F eighty six, with 264-bit 00:07:14.458-->00:07:20.875 architectures, you would use the stack to push arguments to a function. So, here you push 00:07:20.875-->00:07:28.875 arguments to opcodes and then there is like a limited size to the actual stack which is, um, 00:07:28.875-->00:07:33.667 one thousand twenty four elements, and then you would have like two type of storage so 00:07:33.667-->00:07:40.167 like a Persistent one um which is designed er, as it name says to retain data and another one 00:07:40.167-->00:07:50.167 er which is like more volatile, that you can identify easily from the instructions. So, the 00:07:50.167-->00:07:55.542 volatile one is interesting because it’s basically what we would use to like store strings 00:07:55.542-->00:08:01.875 um, but even if you look at it, the way it’s done it’s a little bit dirty but it does the job. 00:08:01.875-->00:08:07.917 Like I was saying, Smart-Contracts are like very, er, er, simple, very simple per 00:08:07.917-->00:08:17.292 design. So, if you do a static or dynamic analysis, um control flow graph and especially if you 00:08:17.292-->00:08:21.667 write a decompiler, one of the most important thing to understand is the actual like 00:08:21.667-->00:08:28.167 control flow of your program. Um, so the first thing we need to know, is basically or to 00:08:28.167-->00:08:34.375 identify basic blocks. Um, so I guess in that case, with Smart-Contract, it’s so much 00:08:34.375-->00:08:40.000 easier than a traditional architecture. Um, because it’s not hard, this concept, of 00:08:40.000-->00:08:47.125 confiscation um, and everything don’t really exist yet with Smart-Contracts, er for sure we 00:08:47.125-->00:08:53.792 expect them in the future, but it’s not like um present yet. So, in most of cases the start 00:08:53.792-->00:08:59.917 instruction is called JUMPDEST, which is indicating like the beginning of a new block, um in 00:08:59.917-->00:09:05.542 most of cases, I’d say like eighty five per cent of them, um you’d have this instruction at 00:09:05.542-->00:09:10.875 the beginning of each block and then you have a bunch of different instructions, er, for 00:09:10.875-->00:09:16.833 like conditional jumps, so very traditional jumps. Um, the difference with traditional um 00:09:16.833-->00:09:22.792 architecture, like you’re on X eighty six for instance, er you’d have your opcode and then 00:09:22.792-->00:09:33.208 your destination, right? In the same, em, in the same opcode. Um, whereas, like here, they 00:09:33.208-->00:09:37.500 first push it on the stack and then execute the opcode for the that. Um, but the main 00:09:37.500-->00:09:42.417 difference is, sometimes you just going to push it at the beginning of the function to a 00:09:42.417-->00:09:47.333 bunch of instructions. So you would like totally forget which er, was like the destination 00:09:47.333-->00:09:51.667 address. So that’s why you’d have to write the pseudo [inaudible] that you would have 00:09:51.667-->00:09:55.833 to emulate most of the instruction to keep track of all the destinations. And, er, 00:09:55.833-->00:10:04.292 basically it one of the main limitation of static analysis of Smart-Contracts also as like 00:10:04.292-->00:10:09.458 most of it could be done er statically. Bust because of those like weird scenarios where 00:10:09.458-->00:10:14.625 like the destination is stored beforehand, um, you have to like emulate like certain basic 00:10:14.625-->00:10:26.833 blocks in order to like keep, um, the er, destination of er, the basic block. Um, for stack 00:10:26.833-->00:10:32.250 manipulations there is basically like a few instructions where you have duplicate, SWAP and er 00:10:32.250-->00:10:39.417 POP and PUSH. It’s pretty straight forward. Um, when it comes to the actual opcodes of 00:10:39.417-->00:10:46.417 Ethereum, you can have different um categories, so obviously the main one is for like arithmetic 00:10:46.417-->00:10:51.333 functions, um, um, it’s mainly designed to deal with money to store, to create like wireless 00:10:51.333-->00:10:56.583 for transactions. Which makes sense, right? And then you have like the block environments and 00:10:56.583-->00:11:01.583 the environmental informations, where you would have information like the sender, the person 00:11:01.583-->00:11:08.083 receiving it and then you have all the memory, um related operation plus logging 00:11:08.083-->00:11:16.375 operations to keep track of certain events. So, like I was saying before, the main thing 00:11:16.375-->00:11:21.667 here, er just as an example, where basically like opcodes are more like functions because you 00:11:21.667-->00:11:28.667 need to push the arguments on the virtual stack. Um, so here, um, you find that addition you 00:11:28.667-->00:11:33.625 would push the two valuables that you want to add, then you would retrieve the arguments, 00:11:33.625-->00:11:42.083 not in the register, but in the first item of the actual stack. Um, so that would come like that 00:11:42.083-->00:11:50.375 if you would write it in a EVM pseudo code um, and then you have like um EVM calls, so those 00:11:50.375-->00:11:55.500 are like pretty interesting , they allow you to like call a different contract, um you have 00:11:55.500-->00:12:01.250 multiple types of calls. You have the regular code, also like delegate call which is what has 00:12:01.250-->00:12:10.583 been abused like recently in the Parity, um contract. Um, which is also interesting from the 00:12:10.583-->00:12:17.375 perspectives that basically you, call like third party libraries that you don’t necessarily own. 00:12:17.375-->00:12:23.208 Um, so this is also an interesting context, um so it leaves a lot of um, 00:12:23.208-->00:12:29.208 opportunities for undefined behavior and um when it comes to um, static analysis, dynamic 00:12:29.208-->00:12:34.333 analysis, or even like trying to define your scope, um once it creates a lot of issues. Um 00:12:34.333-->00:12:41.208 there are like four exceptions for like out coded contracts including for SHA2 to identity 00:12:41.208-->00:12:47.542 function and er for RIPEMD functions. So like the er, contract addresses are like one, 00:12:47.542-->00:12:53.625 two three and four. So whenever you look at the actual bytecode, you would, um, notice like those 00:12:53.625-->00:13:03.125 static addresses. Um, so when it comes down to user defined functions that are exportable by 00:13:03.125-->00:13:09.125 default by each Smart-Contract, you would easily recognized how many parameters they have based 00:13:09.125-->00:13:17.750 on the call data load instruction which is basically reading the um, um, environment 00:13:17.750-->00:13:25.958 information block which is basically, um, like like a like a buffer contents or the inputs 00:13:25.958-->00:13:33.792 parameter including the hash of the function we want to execute. Um, so the structure of that, 00:13:33.792-->00:13:39.000 um, block is pretty straight forward. Like the first four bytes, would be the hash method 00:13:39.000-->00:13:45.708 of the actual er, function which we are going to describe later. And then it would be followed by 00:13:45.708-->00:13:53.750 the arguments. So, if you look at the actual like pseudo code here, so basically, if A and B 00:13:53.750-->00:13:58.708 are being recovered and the first parameter is the actual offset inside the block, um and 00:13:58.708-->00:14:06.292 then for the addition, um that’s what you would get. So, that function is like very simple - 00:14:06.292-->00:14:13.417 so it’s an addition, right, um, but it’s basically what it would look like in a pseudo EVM, um, 00:14:13.417-->00:14:22.083 code. So, when it comes down to type discovery, um the main type you will see, the main type you 00:14:22.083-->00:14:28.333 want to recognize, er are addresses. So, if this is like the address of the er, sender, 00:14:28.333-->00:14:37.708 this destination of the wallet of another contract. Um so it will be um uncoded one sixty 00:14:37.708-->00:14:44.625 bits, right? And most of the time, every time you need ah, something which is not on two 00:14:44.625-->00:14:50.458 fift- two fifty six bits, you will see a hand operation, so in most cases you will see like, in 00:14:50.458-->00:14:56.333 some cases you gonna see it like out coded, but in most of cases you going to see like some EVM 00:14:56.333-->00:15:03.583 assembly, like um, optimization , like here, the following one where it’s using like er, it’s 00:15:03.583-->00:15:09.458 computing like the mask dynamically. Um, so there is like few of them that we can 00:15:09.458-->00:15:17.750 recognize like very easily. And, again, like er, if we do like type discovery while emulating 00:15:17.750-->00:15:24.083 the code, we would actually, um we would even be actually able to just check the mask 00:15:24.083-->00:15:32.375 associated to the instruction. Um, so now, that we have seen all EVMs is kind of working. Um, 00:15:32.375-->00:15:39.167 let’s talk about the bytecode. Now, so you can have two different categories, so you can 00:15:39.167-->00:15:43.667 have like the Pre-Loader code and which is going to be in charge of copying the actual 00:15:43.667-->00:15:49.167 Smart-Contract where like all the interesting stuff is, er inside the executable memory and 00:15:49.167-->00:15:58.167 then, which is er, basically the Runtime code of the contract. And then, um, so the runtime 00:15:58.167-->00:16:04.542 code, which is basically what we want to analyze, contains all the information that we want to 00:16:04.542-->00:16:09.542 ask, spend the time on, so it would contain, er, the whole class, the whole contract so 00:16:09.542-->00:16:15.250 each function. And which is basically like the er, what had been produced by the uh solidity 00:16:15.250-->00:16:21.375 compiler. Um, so this is what the actual like pre-loader looks like, so there is instruction, 00:16:21.375-->00:16:26.583 code called CODECOPY which is basically taking charge of like taking the actual bytecodes of 00:16:26.583-->00:16:30.125 the contracts that we need to put it inside the executable memory. So we can, er, execute 00:16:30.125-->00:16:41.958 it after at the offset zero. Em, once we enter inside the actual, er, Smart-Contract there is like 00:16:41.958-->00:16:48.042 a dispatcher, which is in charge of, em, splitting all the different functions. So the way 00:16:48.042-->00:16:55.250 it works is basically like giant switch instruction, so it would first like recover the hash 00:16:55.250-->00:17:04.042 method from the code data load instruction and from that, um, so here you can see em, when the 00:17:04.042-->00:17:09.375 code optimization is basically just like first reading two fifty six bit register. And 00:17:09.375-->00:17:17.083 then, from that it would like er, apply a mask to any extract the first four bytes. So, that’s 00:17:17.083-->00:17:23.833 basically like the hash method. And then you enter in a switch statement, which on each switch 00:17:23.833-->00:17:32.625 statement is corresponding to an actual function. Um, in some cases you gonna also have a fall 00:17:32.625-->00:17:39.167 back function, so for each, er so if there’s an unknown method which is not recognised by the 00:17:39.167-->00:17:46.667 Smart-Contract, it will just executor method by default. Er, some in cases, um, like in the 00:17:46.667-->00:17:53.292 case of the Parity contract, which is, which is what we are going see after also, so um, it 00:17:53.292-->00:17:59.292 redirects like a call blindly to another contract. Um, well it’s not the kinds of things you’ll 00:17:59.292-->00:18:03.167 see it not doing, you know, people will start to freak out to be honest. But that’s 00:18:03.167-->00:18:10.000 something that seem normal to some people writing Smart-Contract. Um,some of those 00:18:10.000-->00:18:14.250 things, to be honest, seem obscure. Like, er, I don’t really understand why you would 00:18:14.250-->00:18:18.750 have a fall back function, so I mean, I understand why they did it, because of like this thing 00:18:18.750-->00:18:23.583 like they want contracts to be like backward compatible and forward compatible, but the 00:18:23.583-->00:18:28.458 source of so much problem, like er, by design, if you think of security. it doesn’t make sense 00:18:28.458-->00:18:37.375 to be honest. So, um, function hashes, um the way I compute it; basically take the function name 00:18:37.375-->00:18:46.083 and the parameter of each argument, and then er, just like stick them together and compute 00:18:46.083-->00:18:53.750 the share free, um of that um, impute. And the result of the first four bytes would basically 00:18:53.750-->00:19:01.125 be the hash method. So, it’s pretty straightforward, um so um if you have like the um ABI, so 00:19:01.125-->00:19:06.875 the actual interface of the contract, um, you can easily like recompute it. Um, but if 00:19:06.875-->00:19:14.625 you don’t from the actual switch function, you like just extract the actual like hash method, um 00:19:14.625-->00:19:22.417 from the um runtime code and you can create um, um like a name of the fly, like you would do like 00:19:22.417-->00:19:27.167 with either way you just give like um a sub-function with the actual offset of the function 00:19:27.167-->00:19:34.542 when you don’t have symbols. So like with the ABI, justifies the equivalent of symbols for 00:19:34.542-->00:19:41.750 Smart-Contracts. Um, here is the instruction I was mentioning where we basically extract the 00:19:41.750-->00:19:50.042 four bytes. Um, and then um, that’s like the pseudo code for it. So here is a compare reason, 00:19:50.042-->00:19:56.458 if you purely do like static control flow, um like our reconstruction, um you try to 00:19:56.458-->00:20:01.500 emulate, you can see in some cases, er, you really need to emulate the code to keep track 00:20:01.500-->00:20:10.042 of all the actual like destination, um and pointers. Um, so that will be like a 00:20:10.042-->00:20:22.250 simple contract where you would have like two functions, um, which is here. So, once you can 00:20:22.250-->00:20:28.500 start to analyze the actual like runtime code from that, um, like I was saying, it’s basically 00:20:28.500-->00:20:36.667 like a giant switch, each case of the switch is basically a function for it. Um, and then 00:20:36.667-->00:20:44.375 once we decompile it, we get something closer to what’s on the er, right of the screen. Um, 00:20:44.375-->00:20:50.792 to go into it in detail, um the runtime code. So here, for instance, the double functions. 00:20:50.792-->00:20:55.875 In yellow we have actual hash of that function, then it’s going to jump to the offset like at 00:20:55.875-->00:21:05.042 twenty four. Um, which is marked with the JUMPDEST instruction. And then it’s pushing, um the 00:21:05.042-->00:21:11.292 um, argument two, then we arrive in a new block, so here in that case, there is like a JUMPDEST 00:21:11.292-->00:21:16.583 but it’s not in the new basic block, but it’s used by another function , it’s a shared basic 00:21:16.583-->00:21:22.375 block. And then you going to do just like the multiplication and something with the tripper, we 00:21:22.375-->00:21:28.458 going to see is going to read something again like the impute parameter sha3 and then execute 00:21:28.458-->00:21:37.542 like the multiple instruction. So, if we go back to like the initial source code of it, um, 00:21:37.542-->00:21:43.375 it’s basically what it was doing, um it was pretty straightforward. So if we use 00:21:43.375-->00:21:47.708 Smart-Contract that, I wanna say, like way more complex than that, but more complex than 00:21:47.708-->00:21:57.667 this. It was basically to illustrate how easy you can decompile the actual code. Um, 00:21:57.667-->00:22:04.625 if we look at the, er, bug I was mentioning before, this is the Parity Bug that happened like a 00:22:04.625-->00:22:10.750 week ago. Um, remember when I was talking like before, it was like a different call, you have 00:22:10.750-->00:22:21.667 like a call, it allow you to call like a third party contract, um, and then in some 00:22:21.667-->00:22:25.708 cases you have like um, a fall back function that allows you to execute a contra- um like 00:22:25.708-->00:22:32.417 execute code if the method is unknown. So,um , here, like the address, um in the constrictor 00:22:32.417-->00:22:41.250 the address was opcoded and, um you know it’s green, it’s computing the actual hash method 00:22:41.250-->00:22:46.833 dynamically, and then the code is going to execute that specific function. And then for 00:22:46.833-->00:22:55.542 some random reason you ad, er, like a fall back function, that was basically like allowing you 00:22:55.542-->00:23:00.667 to call any function inside the wallet library and to pass function or parameter you want. 00:23:00.667-->00:23:04.333 So, this is why I was saying, like some concept obscure, basically like the er, actual, 00:23:04.333-->00:23:10.333 er, reason for the vulnerability. So obviously, now looking at it it, it’s obvious, 00:23:10.333-->00:23:16.000 but that’s a new type of bugs that have been er, discovered by the architecture. That’s, er, a 00:23:16.000-->00:23:21.167 pretty good find. Now once you know the type of bug it’s pretty, it’s pretty obvious. Um, 00:23:21.167-->00:23:27.167 so like those fall back functions, so if you have like a switch with executing code with 00:23:27.167-->00:23:36.583 er no actual hash, so that’s what your fall back function would be, um, so I mean then 00:23:36.583-->00:23:42.000 it’s a design issue, right? So the main reason for that it is - keep in mind, so it’s adding 00:23:42.000-->00:23:46.458 like a software layer to the blockchain, right? Um, but also means that if there’s a security 00:23:46.458-->00:23:50.708 bug in it, while you cannot patch blockchain, right? That’s the main thing about it’s like 00:23:50.708-->00:23:57.333 retaining data, moving it around. Um, that’s the main reason.From reading about it, 00:23:57.333-->00:24:03.375 it’s backward and forward compatibility. Because of this lack of capability, to apply 00:24:03.375-->00:24:10.208 patches, um to be honest it does not make sense. I think it’s stupid, but, er, whatever. Um, 00:24:10.208-->00:24:15.708 it’s not like you can design a language which is verifiable because you have like too many 00:24:15.708-->00:24:19.708 unknowns, if you like start calling libraries you don’t even know what’s it going to be 00:24:19.708-->00:24:23.667 called. You have to predict all contracts, all er, future contracts, and like imagine if 00:24:23.667-->00:24:29.542 your kernel would be doing the actual same thing, that would be nuts, you’ll see people rioting 00:24:29.542-->00:24:37.167 in the streets, you know? Well, I hope so. Um, so the actual way that bug was fixed was basically 00:24:37.167-->00:24:44.833 like some of the function where the design to be prevent function. um, so when it was 00:24:44.833-->00:24:52.958 able to em, call the library again directly, any function, the actual constrictor. Um, it 00:24:52.958-->00:24:55.958 could even recall the actual constrictor because it will not even check if it was initialized 00:24:55.958-->00:25:01.208 or not. So this is the type of bug you would see in Smart-Contracts. It’s very far 00:25:01.208-->00:25:05.542 away from the er, classical bugs you would see with buffer overflow and everything. Um, 00:25:05.542-->00:25:12.125 there is another example of er like er vulnerable contracts. So, that’s similar to what 00:25:12.125-->00:25:21.500 [inaudible] was using. So like here the vulnerability was basically here, um, it’s similar 00:25:21.500-->00:25:27.042 to a Race Condition so basically same thing - it comes down to like a fall back function being 00:25:27.042-->00:25:33.375 reused. So, er, that would create a Race Condition, where like the balance would not be 00:25:33.375-->00:25:41.667 initialized on time. Um, so for that type of vulnerabilities, the good thing is, because there 00:25:41.667-->00:25:47.000 is not many instructions, you can like tag each basic block to see what they are doing. And 00:25:47.000-->00:25:55.125 every time there is a call with an external contract, you will track at as either a warning or 00:25:55.125-->00:26:00.500 as a neuro so in that case, um we could see that the SStore instruction was being used 00:26:00.500-->00:26:21.750 after. So, it would like be easy to analyze. Um, going to show you a quick demo. So, um, that’s 00:26:21.750-->00:26:35.792 um, that’s um, like the actual Smart-Contract itself. Er, so, so to call the tool you can 00:26:35.792-->00:26:38.167 basically provide the you only need to provide like the actual bytecode. Um, if you have like 00:26:38.167-->00:26:54.750 this symbol, so like the ABI file you can just pass it. And then you just like run the two 00:26:54.750-->00:26:59.958 [pause] and once you give it a name to the tool you can easily reconstr- reconstruct something, 00:26:59.958-->00:27:04.667 er, very close to a the, er, actual source code, so And if you had some like features, 00:27:04.667-->00:27:09.875 because to build a compiler you basically build everything you need for dynamic analysis and 00:27:09.875-->00:27:20.333 also static analysis we can easily, easily um, oh I didn’t see the title there, that’s cool 00:27:20.333-->00:27:26.542 um, you easily like use it to track potential vulnerabilities, just like you would have with 00:27:26.542-->00:27:32.708 most of compilers now when your prefast or per visual studio er, you have a lot of like static 00:27:32.708-->00:27:40.417 analysis tools that can be used. Um, whenever you are writing code, right, so, now if you look 00:27:40.417-->00:27:45.792 at like the actual Smart-Contract community, um they are still like building all 00:27:45.792-->00:27:50.292 those tools, it’s something very new so a lot of the tools that we would find pretty obvious 00:27:50.292-->00:27:56.750 with GCC, your visual studio compiler are not present for, er, those type of software. Um, 00:27:56.750-->00:28:02.042 so because like the whole concept was to introduce a software layer to it, but it 00:28:02.042-->00:28:08.625 comes without a lot of testing tool, um which would be required for enterprise softwares. Um, so 00:28:08.625-->00:28:19.833 so far a few um, class of bugs that have been detected. So the first one was like the Race 00:28:19.833-->00:28:27.125 Condition USD DAO, then Call Stack Vulnerability, um there’s some good papers about it where 00:28:27.125-->00:28:35.500 er, like I was saying before, the virtual stack is limited and when you use all of it, um, it’s 00:28:35.500-->00:28:40.833 not even returning an exception and for a while some issues with like returning exceptions, 00:28:40.833-->00:28:45.417 reverting like a state of a contract as well as like concepts that are very new, have 00:28:45.417-->00:28:50.542 been introduced recently. Um, Time Dependency vulnerability - while some of the actual like 00:28:50.542-->00:28:57.625 um, instruction give you like some time information with the ability to block, um, so you can 00:28:57.625-->00:29:11.792 easily like get get call with what happened with the parateer contract. Um, so there is a fork 00:29:11.792-->00:29:17.458 of Ethereum called Quorum created by J.P. Morgan which is um pretty interesting. The main 00:29:17.458-->00:29:25.167 reason people were a bit worried or so with Ethereum was basically um, um if you are an 00:29:25.167-->00:29:28.167 enterprise you can’t just have everything like return like transparently, so they 00:29:28.167-->00:29:35.500 introduced this privacy layer, and er, permissions to our Smart-Contracts which is pretty 00:29:35.500-->00:29:43.000 cool. Um, like the Quorum team is here, so I don’t know if you guys want to stand up? If people 00:29:43.000-->00:29:49.833 are going to see?But er, that’s a pretty cool project. We see a lot of stuff happening, um 00:29:49.833-->00:29:55.833 around like Ethereum, which is pretty cool and, er, this week like er, Quorum just released 00:29:55.833-->00:30:05.667 um, [inaudible] to Porosity which check like nodes inside the actual network. So, that’s 00:30:05.667-->00:30:11.875 pretty cool too. And like I was saying, the main thing, which is a bit worrying, and what we er 00:30:11.875-->00:30:18.167 hear many like er, stories about the er ICO’s hack, and why for sure we’re going to see more of 00:30:18.167-->00:30:24.667 those stories of the summer is mainly because there is no proper like testing tools for 00:30:24.667-->00:30:29.542 that new like software layer - which is pretty nuts, you know? You, you guys have seen how long 00:30:29.542-->00:30:35.792 it took for traditional software to get like proper security tools Um, er, to be tested, even 00:30:35.792-->00:30:42.625 like, er Azure stuff, this tye of like high level framework, um, while we’ve - 00:30:42.625-->00:30:48.292 Smart-Contracts is pretty much ground zero, I’ve never heard of it in most cases, which is why 00:30:48.292-->00:30:54.583 there’s a need for search tools. Um, here is some like screenshot of the current Porosity 00:30:54.583-->00:31:01.208 integration. So, then it can be integrated in the actual workflow, um, which is um pretty 00:31:01.208-->00:31:08.292 good at least to think of integrating, um, tools like that, um in the actual workflow. 00:31:08.292-->00:31:13.667 It was very fast for the actual Quorum team to do the integration, um, they have a 00:31:13.667-->00:31:20.042 pretty good framework so they can like really add more and more tools very quickly. It’s 00:31:20.042-->00:31:25.042 pretty good and, in my opinion, it’s a requirement if people are going to start really using 00:31:25.042-->00:31:32.167 Smart-Contracts especially to store money. Um, again, like if you write a Smart-Contract, most 00:31:32.167-->00:31:35.625 of the time you’ll use it to store money, right, not to browse YouTube and watch cat 00:31:35.625-->00:31:43.583 videos um, I mean, yeah. You know if you find like a zero day like in a web browser, then you 00:31:43.583-->00:31:47.917 would have to struggle to where to send it. While if you found a bug in a Smart-Contract, you 00:31:47.917-->00:31:53.167 just like take the bank, you know? It’s like being Lazarus Group, but for crypto currency. 00:31:53.167-->00:32:01.167 Um , so like I was saying, for sure we will see more and more, um tests, um, testing tools and 00:32:01.167-->00:32:08.625 like we can definitely expect by the end of the year issues like ICO’s hack, since like it’s like 00:32:08.625-->00:32:14.875 a new thing, everyone wants to like raise money with ICO’s um, we’re getting the tools also - 00:32:14.875-->00:32:21.083 so like some improvement required for like um, um fall out of the conditional statement 00:32:21.083-->00:32:28.000 and um when it comes to Ethereum and security, like I was saying, there is like a fast growing 00:32:28.000-->00:32:33.250 community, especially like the main incentive is, why either you want to steal money or you 00:32:33.250-->00:32:37.500 want to protect your money, right? So it’s pretty straightforward in term of, er, 00:32:37.500-->00:32:43.458 motives if you want to get into like Smart-Contract security. Um, and like I was saying, when 00:32:43.458-->00:32:46.750 I initially looked at it, I was like, why is everybody talking about blockchain, it sounds like 00:32:46.750-->00:32:51.792 really boring, um, then I saw like some virtual machine around, ah maybe there’s some 00:32:51.792-->00:32:57.750 interesting thing to do. And, for those who are like familiar with virtual machine 00:32:57.750-->00:33:06.375 vulnerabilities, um well QMUs has a lot of them, but then you have like, you know like talks 00:33:06.375-->00:33:10.958 like CLOUDBURST that like happened many years ago, um, I think it was Black Hat 2010 or 00:33:10.958-->00:33:18.042 something, um, where basically you would be able to do a VMS escape, and now VMS escape are 00:33:18.042-->00:33:23.208 becoming more and more common, even like Microsoft with their IP vulnerability would be 00:33:23.208-->00:33:28.917 raising their bug bounty. Um well you can be sure if you have your own virtual machine you can 00:33:28.917-->00:33:34.708 also expect bugs in it, right? Um, then the whole thing of claiming it’s sandbox does not 00:33:34.708-->00:33:43.167 really apply. Um, so the question now is: Is Ethereum going to stay alive and if their 00:33:43.167-->00:33:46.750 virtual machine is going to be the main virtual machine, or if we’re going to select more 00:33:46.750-->00:33:50.583 providers for Smart-Contracts with their own virtual machines? Um , I was looking at the 00:33:50.583-->00:33:58.083 roadmap for next year and I saw there are, um planning to use WebAssembly. Um, I had no idea 00:33:58.083-->00:34:03.583 what was WebAssembly, and then I looked into it and basically, um so it’s being described, it’s 00:34:03.583-->00:34:10.625 portable low time efficiency format, so have like your own bytecode um, that can be 00:34:10.625-->00:34:18.750 executed by most of the JavaScript engine like V8 or Spidermonkey, er, and so they’re 00:34:18.750-->00:34:25.625 planning to use a VCM engine that will send your browser to a Smart-Contract, um I don’t know 00:34:25.625-->00:34:30.333 if it’s good, I guess from the fact that it’s also going to be used by all the platforms, it 00:34:30.333-->00:34:37.250 will also benefit of the auditing of that specific language. And in terms of 00:34:37.250-->00:34:42.042 performance, I’ve seen some good stuff. Like if you look at the er demos online, the guys are 00:34:42.042-->00:34:48.083 like running almost like video games with V8’s they can like almost make compile. I don’t 00:34:48.083-->00:34:50.750 know if it’s a good thing or not, but you can like compile like code, C++ code into like 00:34:50.750-->00:34:58.250 WebAssembly, um for an interface it seems a bit confusing to go from like, I think a VM with a 00:34:58.250-->00:35:03.833 specific set of instruction to like being able to compile C++, um, so I don’t know to which 00:35:03.833-->00:35:10.292 extent it’s going to be used in the Ethereum VM by next year, um, but for sure we would see 00:35:10.292-->00:35:18.417 like stuff, um leveraging that. Um, there were some people I wanted to thank, worked with me 00:35:18.417-->00:35:27.708 during the paper, so um including like the DefCon review board, because er, initially I 00:35:27.708-->00:35:31.083 was just like sending the decompilers, - um, can we use it for security? I was like well, 00:35:31.083-->00:35:36.333 it’s a decompiler, so you can do anything. So they kinda pushed me to do a security analysis for 00:35:36.333-->00:35:43.875 it. Um, so if you want to download like the slides and the actual white paper, which is 00:35:43.875-->00:35:49.833 more complete, and, um, in case you didn’t understand my French accent, which I can understand 00:35:49.833-->00:35:55.958 but bit what I can say? I’m French, no, not going to apologise but er, you can 00:35:55.958-->00:36:01.833 download via the actual tool and the rest and yeah, if you have any question, you can either 00:36:01.833-->00:36:08.208 drop me an email or we have free minutes now so I don’t know how it works for like Q&A here? 00:36:08.208-->00:00:00.000 But er, yeah if you have any question, let me know. [applause]