1 00:00:01,570 --> 00:00:05,170 Hey everyone, my name is Martin, thank you for having me. 2 00:00:05,210 --> 00:00:09,950 Today I will be talking about the seven phases of smart contract hacking. 3 00:00:10,030 --> 00:00:28,770 In this talk my idea is not to jump and dive into technical parts of what it means to hack smart contracts, but actually I want to give a little bit of perspective and try to talk about the bigger picture of what does it actually mean to hack smart contracts. 4 00:00:28,850 --> 00:00:46,490 So if you're a pentester, if you're a bug hunter, perhaps working in application security or other realms of information security, you can jump into the Ethereum ecosystem and start helping us secure the entire platform. 5 00:00:46,490 --> 00:00:56,430 So a little bit of background about myself, I'm Martin, I'm a security researcher at Open Zeppelin, one of the leading companies in smart contract audits in Ethereum. 6 00:00:56,830 --> 00:01:11,950 I'm a systems engineer, I'm doing a master's degree in cyber security and cyber defense at the University of Buenos Aires, and I used to work as a pentester mainly on application security, infrastructure, mobile applications, web applications at a big four. 7 00:01:12,290 --> 00:01:16,470 And then I jumped into being a security researcher here at Open Zeppelin. 8 00:01:16,910 --> 00:01:36,930 Well let's say again that you're a pentester, you might be a bug hunter, a white hat hacker, perhaps working in other realms of information security, but you're interested in blockchains and smart contracts, you have heard about them, because to be honest we have hit the headlines a couple of times. 9 00:01:37,150 --> 00:01:44,570 There has been many hacks in the latest months around smart contracts in Ethereum. 10 00:01:44,850 --> 00:01:54,350 So as you see, many hacks and in my opinion we need more and more security experts to jump into the field and to help us secure the entire ecosystem. 11 00:01:54,530 --> 00:01:56,890 So this talk is mainly aimed at you. 12 00:01:57,590 --> 00:02:00,690 And the question is if you can hack a smart contract, right? 13 00:02:00,730 --> 00:02:11,210 What knowledge do you have already that can help you out here in the smart contract world and that you can start applying today to start hacking smart contracts? 14 00:02:12,090 --> 00:02:21,150 And well the answer is yes, that you do have some knowledge, because you do know which are the seven phases, let's say, of a typical security engagement. 15 00:02:21,150 --> 00:02:26,690 And when I say seven, I don't mean to be strict with these phases that we will be talking about. 16 00:02:26,690 --> 00:02:48,530 It's just a way of organizing the talk, but perhaps when you do bug hunting, some phases you might skip them or you might do others, but the idea is to outline our work as security auditors or bug hunters or white hackers in these seven phases, so we can have a common language to talk about this. 17 00:02:49,310 --> 00:02:54,850 Well, these are the seven phases that I have, that we will be talking about. 18 00:02:54,850 --> 00:03:01,650 First, scoping, then reconnaissance, identification of vulnerabilities, exploiting these vulnerabilities that we have found. 19 00:03:01,650 --> 00:03:06,550 What does it actually mean to do post-exploitation in the smart contract world? 20 00:03:06,550 --> 00:03:10,610 And we'll be asking ourselves whether that's an actual thing or not. 21 00:03:10,690 --> 00:03:15,150 And then we'll be briefly covering reporting fixes and retests. 22 00:03:15,150 --> 00:03:17,370 So you might be already familiar with these phases. 23 00:03:17,370 --> 00:03:30,830 The idea of today is to see how these phases apply in the smart contract world and whether we can start drawing some parallels between these phases and the ones that you are used to applying. 24 00:03:31,110 --> 00:03:32,970 So let's get started. 25 00:03:33,450 --> 00:03:35,050 Let's talk about scoping. 26 00:03:36,110 --> 00:03:48,530 If you come from the, let's say, application security world or maybe doing pen testing for infrastructure exposed on the internet, you might be familiar with the fact that you have IP addresses, right? 27 00:03:49,330 --> 00:04:01,070 When you are scoping your work, you will be given IP addresses that will help you understand the systems that you are about to audit or to assess. 28 00:04:01,530 --> 00:04:04,330 In the Ethereum case, we also have addresses. 29 00:04:04,330 --> 00:04:06,430 In this case, we have Ethereum addresses. 30 00:04:06,450 --> 00:04:07,910 I know they are not the same. 31 00:04:07,910 --> 00:04:14,950 I know there are many differences between them, but the idea is to start drawing, as I said before, some parallels between the worlds. 32 00:04:16,050 --> 00:04:27,810 So we can think of these addresses as ways of allocating resources, let's say, in the first case on a network and in the other case on the blockchain. 33 00:04:29,290 --> 00:04:37,370 When you are working on smart contracts, you will not only have one Ethereum address, but you can have many Ethereum addresses that are related to each other. 34 00:04:37,370 --> 00:04:41,990 And you may not even have Ethereum addresses, but actually you can have domain names, right? 35 00:04:41,990 --> 00:04:50,830 As in the classic world, you have the DNS that will help you resolve from human readable names to actual IP addresses. 36 00:04:51,030 --> 00:05:02,150 In Ethereum, we have the Ethereum nice service, which will help you translate human readable domain names like johndoe.eth to Ethereum addresses, such as the one there. 37 00:05:03,250 --> 00:05:11,530 But sometimes, most times actually, you won't have... perhaps you won't have an Ethereum address or many addresses. 38 00:05:11,530 --> 00:05:14,410 You might only have Solidity source code. 39 00:05:14,410 --> 00:05:18,290 And Solidity is the smart contract language that we use nowadays. 40 00:05:18,290 --> 00:05:29,190 There might be others, but Solidity is the smart contract language that is high level and that can help you code smart contracts in an easy way, let's say. 41 00:05:29,190 --> 00:05:43,090 So you might be given a repository with these files or you can actually find that source code in Etherscan, which is the main explorer for the Ethereum blockchain. 42 00:05:43,150 --> 00:05:48,550 And at this point, engagement will become something like a white box engagement, right? 43 00:05:48,550 --> 00:05:59,230 You will have access to the source code, but there are ways, as we will see later, to actually deploy these contracts and to start poking around with them as a living program. 44 00:05:59,230 --> 00:06:05,210 So there are two ways, perhaps, of approaching the assessment. 45 00:06:06,350 --> 00:06:11,350 So if you want to go to Etherscan, you can find the verified source code there. 46 00:06:11,350 --> 00:06:17,050 This is, for instance, the source code for DAI, one of the main stable coins in the Ethereum ecosystem. 47 00:06:17,050 --> 00:06:20,830 And you can go to its address and retrieve the source code there. 48 00:06:20,830 --> 00:06:35,970 But if you don't have the code, you can actually decompile the EVM bytecode and try to read it in a nicer way using EVM, right? 49 00:06:35,970 --> 00:06:51,090 So this is a decompiler for Solidity code and will help you understand what's behind this sometimes difficult to parse EVM bytecode and will give you a more readable way to understand it. 50 00:06:52,650 --> 00:07:00,390 So again, you might have the source code, but if you don't and you only have an Ethereum address, you can use this decompiler that can help you out. 51 00:07:01,290 --> 00:07:06,710 Well, once we are done with this scoping phase, we move on to the second one, which is reconnaissance. 52 00:07:06,710 --> 00:07:12,270 In reconnaissance, we basically want to understand what's in there, right? 53 00:07:13,010 --> 00:07:17,310 So we might be given, as I said before, a list of files. 54 00:07:17,590 --> 00:07:23,730 And we are not only talking about one, two, three, but many, many and several files that you might be given. 55 00:07:23,730 --> 00:07:28,930 And sometimes the names of these files don't even make much sense at the beginning, right? 56 00:07:28,930 --> 00:07:33,270 So we see here like files named flap, flip, flop. 57 00:07:33,270 --> 00:07:37,070 And that is not so self-explanatory, to be honest. 58 00:07:37,170 --> 00:07:43,830 So we need to start looking deeper into the files and to actually understand what they are doing. 59 00:07:43,830 --> 00:07:48,470 But when we look deeper into the files, we will see Solidity code, right? 60 00:07:48,470 --> 00:07:52,230 This is what actual Solidity looks like. 61 00:07:52,390 --> 00:07:55,530 Just a brief example for those that are not familiar with it. 62 00:07:55,530 --> 00:07:59,270 It looks like another object-oriented language. 63 00:07:59,270 --> 00:08:02,110 At the beginning, the syntax is similar. 64 00:08:02,110 --> 00:08:09,050 As you go deeper and deeper into Solidity, you might start seeing several differences with other languages. 65 00:08:09,050 --> 00:08:15,190 But again, the first look of Solidity looks like another object-oriented language. 66 00:08:16,130 --> 00:08:33,190 But if you go to actual files, to actual Solidity files today being used in Ethereum, you will see that sometimes developers are not that clear with their intentions of the code, and you will see that functions have weird names, some variable names are not that clear, 67 00:08:33,190 --> 00:08:38,470 and you cannot make much sense out of the things that you are reading in the code, right? 68 00:08:38,470 --> 00:08:45,730 So it might be a bit disorganized or repetitive, or the function names might not be the best, as we see in these cases. 69 00:08:46,650 --> 00:08:57,230 But luckily, there are tools and there are things that we can start doing in this reconnaissance phase that can help us get more familiar with the code and understand what it's trying to do. 70 00:08:57,390 --> 00:09:14,090 So in this case, what we want is, we want to understand the architecture, the interactions between the contracts, we want to see where the contracts expose functions, because we need to use them as entry points for attacks, we need to see the inheritance chains of this contract, 71 00:09:14,090 --> 00:09:15,390 and many other things, right? 72 00:09:15,390 --> 00:09:19,010 But I want to make a special point on intention. 73 00:09:19,050 --> 00:09:29,350 We as, let's say, auditors or bug hunters looking at Ethereum smart contracts, we need to understand the intention of the code, right? 74 00:09:29,350 --> 00:09:41,730 Intention is not usually the same as implementation, so we need to find the differences between intention and implementation, and actually start digging bugs in that sense. 75 00:09:42,050 --> 00:09:49,770 So special attention to the intention of the code, not only what it's actually doing, but what it intends to do. 76 00:09:50,350 --> 00:10:07,290 For these three last points, for the roles of a system, the integration points, and intention, the work in reconnaissance becomes a bit of a manual work, and reading documentation, reading the code, reading pull requests, perhaps talking to developers, 77 00:10:07,290 --> 00:10:11,290 from those things we can start understanding these points, right? 78 00:10:11,290 --> 00:10:17,450 But for the others, there are tools that can actually help us in a really nice way, as we are about to see. 79 00:10:17,590 --> 00:10:38,030 So if you want to see some things about inheritance chains, for example, you can use EtherScan, we can use Surya, Slyther, which are tools that can help us print these kind of diagrams of inheritance, and can help us understand how do contracts relate to each other in a code base. 80 00:10:38,730 --> 00:11:02,010 Slyther, that is a static analyzer, can also help us see which are the exposed functions of a contract, so we can see whether it has many public functions, which are these public functions, to which contracts do they belong, and if there are private functions in those contracts related to these public functions. 81 00:11:02,030 --> 00:11:04,750 So Slyther can help us explore this. 82 00:11:05,610 --> 00:11:19,350 There are also IDE plugins, such as in Visual Studio Code you have the Solidity Auditor plugin, which is super useful, and as you see here in the GIF, it can help you track, for instance, function calls. 83 00:11:19,410 --> 00:11:30,790 Starting from a public function call, you can go all the way down to the private calls, and see whether in this way you can track different bugs in the code. 84 00:11:31,410 --> 00:11:37,570 And another thing that is super useful, that I at least myself find useful, are diagrams. 85 00:11:37,570 --> 00:11:48,230 So these diagrams are things that you can actually draw yourself, put together yourself, and can help you out really to find several bugs in the code. 86 00:11:48,230 --> 00:12:00,090 So give it a shot, try it out, please don't go so crazy on it, but again can help you understand the relationships between different contracts and functions and dynamics of the system. 87 00:12:02,090 --> 00:12:04,470 So that's about it with reconnaissance. 88 00:12:04,470 --> 00:12:17,010 We have seen tools, we have seen manual things that you can use, and now let's get on to one of the most interesting parts, I guess, which is vulnerability identification. 89 00:12:17,010 --> 00:12:23,790 So this is one of the main objectives of our assessment, is to actually find vulnerabilities in the code. 90 00:12:23,950 --> 00:12:32,470 And if you're a beginner with it, I wouldn't recommend you to start trying to hack smart contracts in crazy new ways. 91 00:12:32,470 --> 00:12:35,870 I would suggest that you start with the basics. 92 00:12:35,870 --> 00:12:49,950 So you might read the Mastering Ethereum book, you can read online databases of known attacks, we have the SWC registry which classifies vulnerabilities and with different test cases. 93 00:12:49,950 --> 00:13:02,250 Of course not all vulnerabilities, not all weaknesses in smart contracts, but the most common ones are there, and you can go ahead and read them and start learning which are the basics of smart contract security. 94 00:13:02,250 --> 00:13:24,050 But if you like learning as playing, like learning by doing, you can play the Ethernode by OpenZeppelin, which is a kind of a capture the flag challenge, a set of challenges actually, and it's super fun and can help you understand how to hack smart contracts and learn about security in that way. 95 00:13:24,450 --> 00:13:34,950 One thing that also always surfaces when we talk about vulnerability identification in smart contracts is this difference between automated and manual work, right? 96 00:13:34,950 --> 00:13:53,830 I think this also happens in, for instance, application security, where you might have scanners that can help you out identify vulnerabilities in an application, but also people or pen testers, hackers, tend to also do some manual work. 97 00:13:53,830 --> 00:13:58,490 So I guess it's always about complementing the automated and manual work. 98 00:13:58,490 --> 00:14:09,490 You shouldn't fully lean towards one or another, but doing both automated and manual work to find out these vulnerabilities. 99 00:14:10,510 --> 00:14:25,150 So in the automated realm, we find many tools that can help us out in Ethereum for smart contracts insolidity, or perhaps you don't even need for some of these tools, the source code, you can only have the EVM bytecode. 100 00:14:25,170 --> 00:14:29,510 We have Slyther, Manticore, Keyedna, Mithril, Veris, Solpacale, and many more. 101 00:14:29,710 --> 00:14:31,790 I won't dive deeper into this. 102 00:14:31,790 --> 00:14:37,790 The program analysis world is extremely interesting and it's a whole world on its own. 103 00:14:37,790 --> 00:14:41,670 The idea of this talk is just to briefly present them. 104 00:14:42,770 --> 00:14:49,370 And to also mention that, of course, the automated tools, while they are good, they might have bugs, right? 105 00:14:49,370 --> 00:14:57,350 They might not always work as expected, they might produce false positives, and they might not even find the most critical bugs. 106 00:14:57,750 --> 00:15:04,990 So last year, we ended up publishing a post when we found a critical vulnerability in the MakerDAO contracts. 107 00:15:05,110 --> 00:15:11,210 And we realized that many of the tools weren't capable of finding that type of bug. 108 00:15:11,210 --> 00:15:23,250 And the forum post became really interesting when the authors of these tools jumped in and started explaining the improvements that they were applying in the tools to actually find the bug. 109 00:15:23,250 --> 00:15:31,950 And I think that right now, many of these tools are already capable of finding this bug that we found at MakerDAO. 110 00:15:32,010 --> 00:15:40,070 So the automated tool world is always moving forward and coming up with new ways of finding vulnerabilities, and that's super cool. 111 00:15:40,290 --> 00:15:42,210 But also, we do manual work, right? 112 00:15:42,210 --> 00:15:46,830 In this case, we focus on the business logic and the intention of the code. 113 00:15:47,330 --> 00:16:03,510 And this actually means that, at least in my experience, most of the most critical bugs that I have found in smart contracts come actually from business logic and not from, let's say, solidity common patterns. 114 00:16:03,750 --> 00:16:16,190 So by understanding the business logic of the contracts, you can actually start highlighting these differences between implementation and intention and start coming up with different attack vectors to break the contract. 115 00:16:16,690 --> 00:16:20,790 Special care should be paid to sensitive functions. 116 00:16:20,790 --> 00:16:37,590 And when I say sensitive, I mean functions that may have convoluted and mixed logic, functions that, let's say, handle decimals, arise signatures, which are usually not so straightforward to do in solidity. 117 00:16:37,590 --> 00:16:44,790 So usually developers need to come up with different hacks to implement, let's say, handling decimals. 118 00:16:44,790 --> 00:16:46,750 So there might be bugs there. 119 00:16:46,750 --> 00:16:57,170 Dangerous math, functions making external calls to untrusted contracts is also something that we should be paying attention to. 120 00:16:57,310 --> 00:17:10,090 And uses of assembly or low-level calls in solidity is usually a good source of vulnerabilities that I have seen in my years doing smart contract audits. 121 00:17:10,090 --> 00:17:18,970 So again, some of these are really important things that we should be paying attention to when we are assessing smart contracts in a manual way. 122 00:17:19,010 --> 00:17:20,370 But there are more, right? 123 00:17:20,370 --> 00:17:24,650 So we can also pay attention to the interactions with external dependencies. 124 00:17:24,650 --> 00:17:43,810 And in this case, let's say, other protocols, price oracles, decentralized exchanges, are points of interaction that sometimes can trigger different dynamics, different functionalities or unexpected things in the system that we are trying to break. 125 00:17:45,030 --> 00:18:02,550 Another thing to pay attention to is the impact of these dynamics, of novel dynamics, extreme unexpected ones, that perhaps the developers didn't take into account when they were developing the system and we should be paying attention to. 126 00:18:02,550 --> 00:18:08,610 So for instance, flash loans have been the big new thing recently in DeFi and Ethereum. 127 00:18:08,610 --> 00:18:22,070 With the introduction of flash loans, we have found that many projects ended up having problems in their dynamics, in their incentives, just because flash loans were available to everyone in the ecosystem. 128 00:18:22,710 --> 00:18:27,790 Having a clogged network is also something to take into account when we are analyzing smart contracts. 129 00:18:27,790 --> 00:18:34,030 What happens if the network is highly congested and transactions cannot go through? 130 00:18:34,170 --> 00:18:44,670 What happens if the price of ETH goes down by half and how would this project that I'm analyzing would react to that? 131 00:18:44,670 --> 00:18:49,990 Another cool thing going on right now in Ethereum is front-running, back-running and transaction ordering. 132 00:18:49,990 --> 00:19:02,430 So there are lots of bots right now in mainnet playing with front-running and back-running and these are things, really interesting things, that we should also take into account if we are trying to find vulnerabilities. 133 00:19:02,430 --> 00:19:07,830 How would the project, the contract we are seeing, react to these kind of things? 134 00:19:10,280 --> 00:19:16,840 Well, once we have found vulnerabilities, it's time for us to exploit them. 135 00:19:16,920 --> 00:19:23,300 Another fun part of doing security research is actually exploit the things that we found. 136 00:19:23,680 --> 00:19:45,680 To do exploiting, what we want is first to have a reproducible attack vector and that means to have some way of sharing with the client, sharing with the bug bounty report that we are about to submit, that we have a reproducible attack vector and we are proving actually that there is a vulnerability and that can be exploited under a certain scenario. 137 00:19:46,020 --> 00:19:52,900 And we also need to understand the impact that actually exploiting this would have in the system. 138 00:19:53,760 --> 00:20:09,720 And for the impact, to be honest, we usually also need to see or to actually to understand how would the system work and how the system reacts to our exploit and what is the actual impact in the business logic of the system. 139 00:20:09,720 --> 00:20:16,700 So we need some knowledge, business logic related knowledge, to the system that we are assessing. 140 00:20:18,460 --> 00:20:24,060 To do exploiting, my recommendation is to also try your exploits in a local testing environment. 141 00:20:24,060 --> 00:20:26,580 You shouldn't do that at mainnet, of course. 142 00:20:26,580 --> 00:20:29,440 So you can first spin up a local node. 143 00:20:29,440 --> 00:20:32,100 You can do that with ganache or with geth. 144 00:20:32,120 --> 00:20:37,800 Geth allows you to have a development mode so your test will run faster. 145 00:20:37,800 --> 00:20:41,920 And with ganache, there is a cool feature that you can do is to actually fork mainnet. 146 00:20:41,920 --> 00:21:02,000 And so you can point ganache to a, let's say, a full node, fork mainnet into your local environment and actually run your exploits as if they were to be run on mainnet, but you will be like causing no damage to any project out there. 147 00:21:02,180 --> 00:21:12,400 To interact with nodes, you can use, if you are hacking on javascript, you can use web3js or ethers, but I think that web3 is also available for python. 148 00:21:12,400 --> 00:21:34,120 And if you are wanting to do bigger things that perhaps it would be too difficult to only do with web3js or with ethers, you can use biddler or truffle, which are kind of frameworks or task runners that can help you do more crazy and bigger things with your exploits. 149 00:21:34,720 --> 00:21:38,420 These are the ones that I personally use and the ones I recommend. 150 00:21:38,420 --> 00:21:42,240 But of course, there might be others out in the space that can help you out too. 151 00:21:42,520 --> 00:21:59,080 If you want to see some exploit examples actually using some of the tools that I just mentioned, we have published in the OpenSampling GitHub repository an exploit for the Uniswap vulnerability that was found by another auditing company, by Consensus Intelligence, 152 00:21:59,080 --> 00:22:10,320 last year, and that we ended up publishing a proof-of-concept exploit on how that vulnerability can be exploited for some kind of tokens in Uniswap pools. 153 00:22:10,640 --> 00:22:18,060 And the exploit is readily available there and is public and for you to see and run it in your local machines. 154 00:22:18,060 --> 00:22:28,900 Interestingly, this exploit was actually, I don't know if this particular exploit, but the vulnerability was later exploited in the wild in some real Uniswap pools. 155 00:22:29,540 --> 00:22:35,840 I have also published myself some exploits examples in my GitHub repository. 156 00:22:36,180 --> 00:22:47,880 And in February this year, for example, we also at OpenSampling published a way to backdoor non-c-safe wallets, one of the most popular wallets in the space, during deployment. 157 00:22:48,280 --> 00:23:01,780 And in this post, I'm leaving you the link there, in this post we are actually publishing the proof-of-concept exploit on how to backdoor non-c-safe wallets during deployment. 158 00:23:02,700 --> 00:23:08,700 But also we have the possibility to reproduce real exploits in Ethereum. 159 00:23:08,700 --> 00:23:20,860 So you can see here a transaction, an execution trace of a transaction that actually stole more than 24k USDC last week on a project in Ethereum. 160 00:23:20,860 --> 00:23:34,960 On mainnet this is real and the attack not only was made up of this single transaction but many transactions and caused a lot of fund losses in this project. 161 00:23:34,960 --> 00:23:39,140 So you can actually see these transactions because transactions are public in Ethereum. 162 00:23:39,140 --> 00:23:48,040 You can see the interactions between the contracts and you can even go ahead and reproduce these real exploits on your local environments. 163 00:23:48,040 --> 00:23:50,440 So that is something pretty cool. 164 00:23:51,660 --> 00:23:58,020 Well, moving on, after exploiting we can begin talking about post-exploitation, right? 165 00:23:58,020 --> 00:24:06,960 So the big question here that I've been asking myself when preparing this talk is if this is even a thing, right? 166 00:24:06,960 --> 00:24:30,540 So in the application security world perhaps you might be thinking of pivoting, opening a shell, moving to other systems, jumping around the network, but perhaps in the smart contract world that is not possible or it is not that easy to draw a parallel between the smart contract and other worlds. 167 00:24:30,580 --> 00:24:46,500 So again, we shouldn't think of having a shell here but perhaps we can start thinking about, when thinking about post-exploitation, we can try to extend or elevate access to the smart contracts. 168 00:24:46,500 --> 00:24:56,100 We can cause further consequences in our components or even in other protocols by going beyond the exploited system that we are assessing, right? 169 00:24:56,100 --> 00:25:03,580 So in that sense there might be some parallels between in this post-exploitation phase. 170 00:25:04,360 --> 00:25:11,240 So let's go to an example to better see what I mean by post-exploitation here. 171 00:25:11,240 --> 00:25:15,000 So let's see a compromised oracle case. 172 00:25:15,040 --> 00:25:26,460 In this case, let's imagine a platform that is selling collectibles, is selling these kitties and you pay ETH and it will give you away some kitties depending on how much ETH you have paid. 173 00:25:26,720 --> 00:25:37,900 But this platform actually uses the price in ETH of these kitties but uses a price oracle to fetch the price in ETH, right? 174 00:25:37,900 --> 00:25:45,000 The price oracle is basically another set of contracts where the price in ETH of these kitties is registered by someone. 175 00:25:47,620 --> 00:25:59,960 But in this case, if you can end up finding a vulnerability in the price oracle and you can compromise the price oracle, you can actually compromise the system that is relying on that oracle, right? 176 00:25:59,960 --> 00:26:09,440 Because you can set, for instance, the price in ETH of this collectible to zero, you can send a transaction to buy all kitties and you can steal away all kitties in this platform. 177 00:26:09,580 --> 00:26:18,820 And that is not also true for a single platform that relies on this oracle, but it's also true for all platforms that are actually relying on this price oracle. 178 00:26:18,820 --> 00:26:22,340 This is an actual problem that I think that we have nowadays in Ethereum. 179 00:26:22,340 --> 00:26:38,880 The more projects that are relying on a single oracle or just a small number of oracles, the greater the incentives, the economic incentives to attack a price oracle, to compromise it and to basically pound every single project depending on it. 180 00:26:38,900 --> 00:26:42,360 So this is basically what I mean with post exploitation. 181 00:26:42,360 --> 00:26:51,620 We can compromise an oracle and by doing that we can move on to other projects and execute attacks in them as well. 182 00:26:53,990 --> 00:27:10,310 Moving on, we have this last phases which is about reporting, doing fixes, retests and I believe that there are many similarities with other information security realms. 183 00:27:10,490 --> 00:27:13,410 So I don't think I should dive deeper into this. 184 00:27:13,830 --> 00:27:28,010 Of course we do reporting, of course we review the fixes for our clients, of course we do retests to make sure they haven't reintroduced the vulnerability and have actually fixed the things that we have reported. 185 00:27:28,010 --> 00:27:30,790 So we do all of that, that is basically the same. 186 00:27:30,790 --> 00:27:41,290 But one thing that we should be highlighting here is that in the Ethereum world most, if not all, but most security reports are public. 187 00:27:41,290 --> 00:27:43,450 That is something that you don't see in other worlds. 188 00:27:43,450 --> 00:27:55,570 That is something that, for instance, me working as a pen tester for banks in my previous job, I wouldn't have even imagined that I could at some point make public a report, right? 189 00:27:55,570 --> 00:28:11,870 But in the Ethereum world that is true, you can do that, of course agreeing that with the client, but I think everyone is encouraged to actually public their security reports because in that way we can all improve the ecosystem, we can all learn about the best security practices, 190 00:28:11,870 --> 00:28:30,490 which things might not be the best for some types of projects, and also to have perspectives of other security auditors in the space and learn from each other and make everything in the open and as transparent as possible. 191 00:28:30,490 --> 00:28:48,150 So we have public security reports and you can go to, for instance, our blog at OpenZeppelin and many other companies as well are publishing their reports and you can read them and learn tons about smart contract hacking and security and research just by reading those public security reports. 192 00:28:48,150 --> 00:28:52,890 So that is something that I wanted to highlight because I think it's super valuable in the space. 193 00:28:54,690 --> 00:29:01,150 Well, and to end this talk I wanted to leave you with a little surprise, right? 194 00:29:01,150 --> 00:29:17,690 I don't think today I have covered many things on the technical side just because I wanted to, as I told you at the beginning, I wanted to give you the bigger picture of what does it mean to hack smart contracts and how do we structure our engagements. 195 00:29:19,090 --> 00:29:30,110 But if you actually want to look at code and run some exploits and try to break smart contracts, I think you might find this super useful and entertaining. 196 00:29:30,110 --> 00:29:37,370 It's time for you to start hacking smart contracts so you can start applying all these learnings from these phases that I have been telling you about. 197 00:29:37,370 --> 00:29:54,550 You can go to my github repository, it's already public, and you can start hacking a set of smart contracts that is based on a governance system using flash loans and token snapshots, all things and features super popular nowadays in the FIFA space. 198 00:29:54,550 --> 00:30:02,870 And here you have an example on how that can be severely broken and you can be the one attacking it and breaking it. 199 00:30:02,870 --> 00:30:10,270 So please have fun with it and hope to get some feedback on that if you happen to play it. 200 00:30:10,670 --> 00:30:19,390 So thank you very much, you can contact me on telegram, on twitter, on github and all these platforms. 201 00:30:19,430 --> 00:30:28,810 You can find me as Tim Chavate and you can learn more about information security related to smart contracts in our forum, in our blog at Open Zeppelin. 202 00:30:29,670 --> 00:30:40,510 I'm happy to help you out with anything related to this and please ping me if you find this interesting. 203 00:30:40,510 --> 00:30:41,430 So thank you!