Transaction simulation, the good, the bad & the ugly by Kim Persson | Devcon SEA

[Music] hello everyone um my name is shei and I'm a security engineer at Fen and uh for the for the past year we have been digging into them well so we have some uh insights to share to bring some new methodologies into this world and uh the topic is how to fund run transaction in the future so in 2023 we have seen a lot of fundr Runners has rescued millions of dollars in the hacking incidents for example like C they rescued U 5.4 million and also bloack and also in the kyber swap incident they rescued 5.7 million and return those funds to the protocols these are like white hat hackers but we are seeing a decline declining trend for this uh in 2024 and there are main some some reasons for that so before that let me go over around uh about uh background of MV and for earning so this is how a transactions life cycle so on the top you can see when the user want to send the transaction he want to send it to the Builder first then the validator then the validator will propose a block and commit it to the chain but if there is a front runner uh when the user sends the transaction to the Builder the Runner will see this transaction and uh he when he detects this transaction is profitable he'll replace the beneficiary to himself and then add a little bit more gas onto that so the Builder will place his transaction in front of the normal transaction so the um users transaction will be reverted so the front runner will gain profit from this so then the role of private M came they say we will keep transaction private uh and this is beneficiary for most parties first Arbitrage are fair like MV boss they want to balance the pools they find the a better swap path when and also user they don't need to suffer from um sandwiches and also the side effect of this is that hackers transactions they are protected by the pr and pool as well uh for example in the previous uh examples uh those phone Runners are not able to phone run with a private transaction and is fun running dead and we found the re uh answer to this question is no not on the Block Level let me explain that so we have seen a lot of patterns like this it's called a two-phase style attack so first uh if if a hacker want to hack something he will first deploy a assistant contract and do some preparation and finally he'll send another transaction to trigger the vulnerable function of the victim so to exploit it um all a mbot or a fund runner needs to do is is to extract all the functions of a contract uh by using the function signatures and call every function and if it happens to be the trigger function uh aont runner will be able to like front run this transaction that that has not never been sent to the Builder before and so it becomes a uh catam Mouse game between the MV Bots and hackers and there are like hackers they are they thought of some like better strategies to protect their contracts for example here we have a address verification B it's easy to bypass all it B need to do is to add some hints and also if it has a authentication uh like here you you have a hash of some uh address uh if it's compared it's compared to a fixed hash but all a bot needs to do is to change that equal sign to a not equal sign and also then hackers thought of some more sophisticated uh methods for example they hide the parameter to uh to the vulnerable function directly in the parameter in the function and we found that the goal is really to find the input to trigger a profitable path in the contract because it's already in this contract and fuzzing is a good tool to do that so what is fuzzing it's basically generate a random input this random is not really random uh and then it execute the program observe and analyze the execution collect interesting information and if it's a profitable path we will exit otherwise we repeat using the collected information and there are different purposes for fuzzing in web two you might be corrupting corrupting some memory in web three AIO space it might be break some invariance and here we are really to find a um profitable path so the effects really depends on the input generation here are some heris uh functions uh or generation methods we uh want to offer you and the important thing is about theistic functions uh these are the that makes the fuzzing different and there are some pros and cons to fuzzing for example it's fast accurate and easy to build a prototype and also for the conss uh it can be timec consuming uh especially in some chains that have a very low block time interval and what we want to um promote is that I think we should bring more Web Two methodologies into web 3 for example we haven't seen sta analysis something like that and we bringing fuzzing also adding added some TT analysis and symbolic execution into our engine and yeah we're hoping to see more of this and that's the end of my talk I'm ready to take any questions thank you so much T any questions the last chance to ask questions before the end of today anyone wants to give a go no questions okay thank you chi and that wraps up the day of lightening talks what an incredible series we had today and uh thanks you thanks for all attending and all our speakers and tomorrow will continue so hopefully see you tomorrow [Music] t o [Music] up