📕 BETTER THAN YESTERDAY WITH BSCSTATION #10: Blockchain Attacks You Should Know Part 3
Better Than Yesterday With BSCStation is back with another part of “Blockchain Attacks You Should Know”!
In the previous post, BSCStation talked about “User Wallet Attacks” and gave out tips to prevent such accidents. Today let’s continue with the “Smart Contract Attacks”.
Smart contracts are becoming a well-known term in blockchain technology, especially in the Decentralized Finance (DeFi) ecosystem. When the openness of smart contract implementation is considered, it becomes apparent to all blockchain users. However, security weaknesses and vulnerabilities may become obvious at times.
Furthermore, hackers or cyber criminals may use these potential security issues to further disrupt a company’s smart contract, resulting in massive revenue loss and client data leakage. While most people acknowledge the need for audits in cybersecurity, just a few take it seriously.
We will define seven attack techniques that can seriously impact a smart contract application. Successful execution of such attacks may lead the smart contract to perform expectedly. Hence, parties associated with the contract agreement might incur a severe loss.
Smart Contract Attacks
The main blockchain security issues associated with smart contracts relate to bugs in source code, a network’s virtual machine, the runtime environment for smart contracts, and the blockchain itself. Let’s look at each of these attack vectors.
Reentrancy
Reentrancy is considered to be one of the most catastrophic attack techniques in the smart contract. This attack technique is able to fully destroy the contract or steal valuable information.
Reentrancy may occur when a function calls for another contract through an outer call. The exploitation allows an attacker to execute a recursive callback of the main function, making an unintended loop which is repeated many times.
For instance, when a vulnerable contract contains a revoke function, the
contract may call the revoke function illicitly numerous times in order to drain any available balance the contract comprises. Single function Reentrancy attacks and cross-function Reentrancy attacks are two different types that the attackers can exploit. The exploitation allows the attacker to use external calls to execute the desired tasks.
Smart Contract Overflow and Underflow
This vulnerability is relatively easy to initiate and occurs in transactions accepting unauthorized input data or value. Smart contract overflow occurs when more value is provided than the maximum value. The contracts are written in Solidity, which can handle up to 256-bit numbers; thus, an increment of 1 would cause an overflow. Conventional testing approaches are inadequate for determining overflow vulnerability in smart contacts.
Smart contract underflow occurs in the opposite way to overflow. However, the underflow attacks are more simple to perform as achieving the required token to cause overflow is often challenging for attackers.
Short Address Attack
This vulnerability occurs due to the weakness of the Ethereum Virtual Machine (EVM). The EVM permits imprecise padded arguments allowing adversaries to dispatch specially crafted addresses that result in exploitation.
The Short Address Attack follows a similar attacking strategy as a SQL injection bug. When an underflow is detected, the EVM includes a zero at the end of the address in order to ensure that it comprises a 256-bit datatype. However, an adversary can take advantage of this vulnerability by omitting the very last zero from the ether address. This vulnerability is an input validation bug and mainly occurs from the sender’s side due to weak transaction generation code.
Delegatecall
The Delegatecall feature shows that it is possible to introduce flaws while building custom libraries and it can also lead to new vulnerabilities.
Delegatecall vulnerabilities can be avoided by observing for a lapse on both the library contract and calling contract and, in addition, developing state-less libraries whenever feasible.
Default Visibilities
The visibility specifiers in the Solidity function control the manner in which a function is to be called. The visibility specifier also takes control when permitting users to call for external functions by derived contracts.
Improper implementation of the visibility specifiers can cause serious effects in the smart contract. The default visibility is always set to public for functions, allowing external contracts to call for visibility when functions do not explicitly mention it. This vulnerability arises when developers neglect to set the visibility specifier to private.
Transaction Ordering Dependence
Transaction Ordering Dependence (TOD) is a vulnerability that can allow corrupt miners to have a serious effect on smart contracts. This vulnerability is a very common security bug in the smart contract, relying on the order of transaction execution.
For example, a newly generated block contains 2 transactions enforcing the same smart contract. Such plots do not provide enough information to users to determine the state of the contract or when the individual invocation is initiated. Therefore, when the output of both transactions is dependent on the order, the contract results in a TOD vulnerability.
In the Ethereum blockchain, the miners are in charge of controlling the order of transactions, prioritizing transactions with higher gas. Hence, any miner that closes a block can influence the order of a transaction. The ability for potential miners to influence the transaction order for illicit activities is an outcome of Transaction Ordering Dependence (TOD).
Timestamp Dependence
Timestamp Dependence is another vulnerability that can be exploited by corrupt miners. In order to gain a benefit, a miner may re-arrange the timestamp by a few seconds.
The timestamp dependence vulnerability occurs from a flawed comprehension of timekeeping. It enables the Ethereum network to be detached from the synchronized global clock.
For example, a smart contract utilizes the current timestamp to produce random numbers in order to determine the lottery result. Since the smart contract permits miners to put up a timestamp within 30 seconds of block validation, this gives a miner more opportunity for exploitation. Hence, the outcome of the random number generator can be altered to gain benefits.
Conclusion
Smart contract technologies enable users to form decentralized digital agreements without the need for a third party. The smart contract technology attracted sectors such as health, business management, shareholder agreement and insurance. However, the more this technology expands, the more it catches the attention of potential attackers, resulting in several severe exploitations.
We have pointed out that a proper solution to secure smart contracts remains a challenge and future work will involve developing strategies to detect and mitigate the major security flaws presented.
About BSCStation
BSCStation - The fully decentralized protocol for launching new ideas. An all-in-one Incubation Hub with a full-stack Defi platform across all main blockchain networks. We provide exclusive services including IDO/INO Launchpad, Yield farming, NFT Auction, Marketplace, and BSCSwap.
BSCStation operates on top of all the main blockchain networks and is designed to offer maximum value to consumers and institutions.
BSCStation platform uses the Sharing Economy Model for the purpose of profit-sharing, helping users to access DeFi platforms in the easiest, safest, and most cost-effective way. BSCStation is the most convenient bridge to connect users and application products on all main blockchain networks.
Website | Telegram | Substack | Twitter | Channel
The information provided in this article is intended for general guidance and information purposes only. Contents of this article are under no circumstances intended to be considered as investment, business, legal or tax advice. We do not accept any responsibility for individual decisions made based on this article and we strongly encourage you to do your own research before taking any action.