Access control vulnerabilities in smart contracts were one of the primary factors leading to the Poly Network cross-chain bridge hack with losses of $611 million and contributed to a $300,000 hack of the ShadowFi DeFi project on Binance Smart Chain (BSC).
Pseudo-Random Numbers
Smart contracts often maintain state variables that track balances. However, direct transfers not mediated by contract functions (like direct Ether sends to a contract address or transfer calls for ERC20 tokens that bypass the contract's logic) can create discrepancies between the actual balance held by the contract and the balance recorded in the contract’s internal state variables.
Many free-mint projects utilize the isContract() method to limit access to external accounts (EOAs) and restrict contract addresses. This method leverages extcodesize to determine the runtime bytecode length of an address. If it is greater than zero, the address is deemed a contract; otherwise, it is considered an EOA.
In April 2022, a popular NFT project called Akutar conducted a successful Dutch auction to raise funds, amassing 11,539.5 ETH. However, when processing refunds for previous community pass holders, a flaw in their smart contract prevented operations, locking all funds within the contract due to a DoS vulnerability.
ERC20 transfer issues are a common source of vulnerabilities in smart contracts. These issues arise from inconsistent implementations of the ERC20 standard, particularly in how different tokens handle the return value of transfer functions.
Excessive function restrictions in smart contracts can lead to critical issues such as funds being locked, which can prevent rightful access even in necessary situations. A well-documented example is the Akutars NFT incident, where $34 million in Ethereum was trapped due to overly restrictive contract mechanics intended for security.
Flashloans are a powerful feature in decentralized finance (DeFi) that allows users to borrow assets without collateral, under the condition that they return the borrowed amount within the same transaction. This feature has enabled unique financial strategies, but it also poses significant risks for governance systems.
If access control is about controlling who calls a function, input validation is about controlling what they call the contract with. This usually comes down to forgetting to put the proper require statements in place.
One of the most significant incidents involving an integer overflow vulnerability occurred with the BeautyChain (BEC) token in April 2018. This exploit allowed attackers to generate an astronomical number of BEC tokens from thin air, leading to a substantial financial loss and undermining the token's value.
When developing smart contracts, security is one of the most critical considerations. This tutorial will delve into a common but dangerous pattern: using msg.value within loops. We'll explain why this is dangerous and provide some best practices to avoid related vulnerabilities.
Price manipulation poses a significant risk to smart contracts that utilize decentralized exchanges (DEXs) like Uniswap, where asset prices are influenced by the liquidity within trading pools. These pools are vulnerable to manipulation by well-resourced entities capable of altering market balances to artificially influence prices. Such manipulative actions can severely undermine the functionality and security of financial applications that rely on this pricing data for essential operations.
When developing smart contracts, it's crucial to understand that marking variables as private does not make them confidential. This tutorial explains why private variables are still accessible and provides best practices for handling sensitive information in smart contracts.
Re-entrancy attacks are among the most common types of assaults on smart contracts, where attackers exploit contract vulnerabilities to recursively call the contract, enabling them to transfer assets out of the contract or mint a large number of tokens.
In Solidity, downcasting from a larger integer type to a smaller one can be hazardous due to the lack of automatic overflow checks in versions before 0.8.0. This tutorial explains the risks of downcasting, provides an example of a problematic function in older Solidity versions, and offers a solution using a library like SafeCast to ensure safe operations. Even though Solidity 0.8.0 and later versions include built-in overflow checks, using SafeCast can enhance code clarity and safety.
The selector collision attack was one of the key reasons behind the hacking of the Poly Network cross-chain bridge.
Signature Replay Attacks
Ensuring the security of smart contracts is crucial as they directly handle and store value, and are difficult to modify once deployed on a blockchain. To secure your smart contracts, follow these key steps and best practices:
A transaction origin attack is form of phising attack that can drain a contract of all funds.In Solidity, tx.origin retrieves the address of the transaction originator, distinguishing it from msg.sender.
Unchecked low-level calls are a common source of vulnerabilities in smart contract development. These calls include call(), delegatecall(), staticcall(), and send(), which do not revert the transaction when they fail but instead return a boolean false. Failing to check these return values can lead to critical security issues.