19 篇文档带有标签「Security」

Pseudo-Random Numbers

Smart contracts often maintain state variables that track balances. However, direct transfers not mediated by contract functions (like direct Ether sends to a contract address or transfer calls for ERC20 tokens that bypass the contract's logic) can create discrepancies between the actual balance held by the contract and the balance recorded in the contract’s internal state variables.

ERC20 transfer issues are a common source of vulnerabilities in smart contracts. These issues arise from inconsistent implementations of the ERC20 standard, particularly in how different tokens handle the return value of transfer functions.

Excessive function restrictions in smart contracts can lead to critical issues such as funds being locked, which can prevent rightful access even in necessary situations. A well-documented example is the Akutars NFT incident, where $34 million in Ethereum was trapped due to overly restrictive contract mechanics intended for security.

Flashloans are a powerful feature in decentralized finance (DeFi) that allows users to borrow assets without collateral, under the condition that they return the borrowed amount within the same transaction. This feature has enabled unique financial strategies, but it also poses significant risks for governance systems.

If access control is about controlling who calls a function, input validation is about controlling what they call the contract with. This usually comes down to forgetting to put the proper require statements in place.

When developing smart contracts, security is one of the most critical considerations. This tutorial will delve into a common but dangerous pattern: using msg.value within loops. We'll explain why this is dangerous and provide some best practices to avoid related vulnerabilities.

Price manipulation poses a significant risk to smart contracts that utilize decentralized exchanges (DEXs) like Uniswap, where asset prices are influenced by the liquidity within trading pools. These pools are vulnerable to manipulation by well-resourced entities capable of altering market balances to artificially influence prices. Such manipulative actions can severely undermine the functionality and security of financial applications that rely on this pricing data for essential operations.

In Solidity, downcasting from a larger integer type to a smaller one can be hazardous due to the lack of automatic overflow checks in versions before 0.8.0. This tutorial explains the risks of downcasting, provides an example of a problematic function in older Solidity versions, and offers a solution using a library like SafeCast to ensure safe operations. Even though Solidity 0.8.0 and later versions include built-in overflow checks, using SafeCast can enhance code clarity and safety.

The selector collision attack was one of the key reasons behind the hacking of the Poly Network cross-chain bridge.

Signature Replay Attacks

A transaction origin attack is form of phising attack that can drain a contract of all funds.In Solidity, tx.origin retrieves the address of the transaction originator, distinguishing it from msg.sender.

Unchecked low-level calls are a common source of vulnerabilities in smart contract development. These calls include call(), delegatecall(), staticcall(), and send(), which do not revert the transaction when they fail but instead return a boolean false. Failing to check these return values can lead to critical security issues.

In April 2022, a popular NFT project called Akutar conducted a successful Dutch auction to raise funds, amassing 11,539.5 ETH. However, when processing refunds for previous community pass holders, a flaw in their smart contract prevented operations, locking all funds within the contract due to a DoS vulnerability.

2018年4月，BeautyChain（BEC）代币上发生了一起涉及整数溢出漏洞的重大事件。 该漏洞使攻击者能够凭空生成大量的BEC代币，导致了巨额财务损失，并削弱了该代币的价值。

确保智能合约的安全至关重要，因为它们涉及财产的直接处理与存储，并且一旦合约被部署在区块链上，就很难修改。 为了保护你的智能合约，遵循以下关键步骤和最优的实践方法：

许多免费铸造的项目使用 isContract() 方法限制对外部账户（EOAs）的访问以及限制智能合约的交互。 此方法使用 extcodesize 来决定地址运行时 bytecode 长度。 如果大于零，则被视为智能合约；否则，它被视为EOA。

智能合约的访问控制漏洞是导致 Poly Network 跨链桥黑客攻击（损失 6.11 亿美元）的主要因素之一，并且也导致了在币安智能链（BSC）上的 ShadowFi DeFi 项目遭受 30 万美元的黑客攻击。

重入攻击是针对智能合约最常见的攻击类型之一，攻击者利用合约的漏洞递归调用合约，使其能够从合约中转移资产或者铸造大量的代币。