# Blockchain Autopsies - Analyzing selfdestructs by Jay Little (Devcon4)

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2019-10-09
- Duration: 06:21
- Topics: blockchain, smart contracts, distributed ledger, Science & Technology
- Watch: https://streameth.org/watch/yt-LA9nVXtF2ME
- YouTube: https://www.youtube.com/watch?v=LA9nVXtF2ME

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/4/blockchain-autopsies-analyzing-selfdestructs

On the blockchain, contracts may be lost but are never forgotten. Of the over 1,800,000 Ethereum smart contracts ever created, more than 54,000 are empty. When a contract’s purpose is fulfilled, the owner typically triggers a self-destruct switch that removes code and state. These steps are similar to what an attacker would do after hijacking a contract. Is it likely the selfdestruct was intentional or performed by a trusted third party? Or was it a hack or fraud? Old contracts have been purged from the world computer’s working memory but they can be reconstructed and analyzed. By investigating the transactions leading up to the selfdestruct, the circumstances of contract deaths can be determined. 

Speaker(s): Jay Little
Skill level: Intermediate
Track: Security
Keywords: contracts, intentions, selfdestruct

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 4 was held in Prague, Czech Republic on Oct 30 - Nov 2, 2018.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

everybody my name is Jay little I'm a principal security engineer at ray lab it's my hobby over this past summer was trying to sync archive nodes and then figure out why some contracts have been self-destructed so I'm gonna quickly go over like how I did this and then share the results case anybody needs a brief refresher of what a self-destruct looks like imagine like you have some contract people are using it they're baking cookies the owners keeping track of who has what cookies then the owner wants to close up the shops they do a self-destruct when they do this the owner gets all the money collected by the shop and when this happens the code and all the storage gets removed from all the etherium clients on the node so because of that the self-destruct is a type of internal transaction so in order to get this information you need to run full node with archiving and these are curated command-line arguments I found from Stack Overflow that'll be performance and archiving and then you wait a few weeks and then you run into some crashing errors turns out this summer was a bad time to try to get a working archived node these have been fixed but it kind of felt like I was making a Zen garden out of my chain data' folder I'd have to like remove it and start again so I still wanted to make some results so luckily ether scan has an API they will give you a list of all the transactions to a contract and all the internal transactions - it took about a few hours to download ether scan lets you do about 5 queries per second and here are some results so total there's been about 2 million contracts is created before block 6 million on main that and of those 32,000 are empty and a subset of these empty ones have been self destructed it's a little hard to tell the difference between the two so as we kind of apply somewhere heuristics for like Oh as is this self destruct interesting or not like is the account that caused the self-destruct the original creator or not or to send money back to the original but account or some new one we get down to just 25 total self destructs ever that sent more than point one Eve this was kind of surprising so I started digging through the results and it turns out there's a lot of duplicated noise there's a 10,000 copies of this contract that kind of read code in a loop and some Stack Overflow post says this was a network toss then there's this one's kind of unfortunate there's been about 6,000 eath lost by people sending some money to address 0 and then not giving any data so that's these are gone forever then there's about 2000 of these for their 6000 dolls nulls is just a stop it doesn't do anything so no contracts created so it's empty then there's this thing that's really annoying there's about 3,000 of these contracts that just do a push and then a self-destruct so they just kind of transfer one or two way and when you look at it either scan it looks like a huge mess and it turns out that what these are doing is they will self-destruct and then that triggers a transaction and then it kind of does like a little bit of a chain reaction and this was like really annoying to filter out so we do all this filtering and we're left with about 2000 contracts that have been like legitimately self-destructed that had code and now they don't and if we like again if we apply some heuristics there's actually only like out of the 25 that have 7.1 Eve there's only 16 they've sent more than one either when they were being destroyed so for a few of these kind of highlights of this result this one the original owner actually destroyed his contract and sent 50th to zero rip then this one I got excited because I'm like 300 even a self-destruct but it turns out when you look at previous transactions the owner was intentionally changed by the original creator so this probably wasn't attack then the rest of the results are actually pretty much as gambling this one had a few ether in it 65 and it had a cool address it begins with dice so you know it's like a trustworthy playing contracts then here's another one the transferred a few ether this actually its source code was and a pretty legit looking website this is a contract that was attacked and the attacker called a couple functions and got a bounty of 0.2 eath I'm actually the original author of this contract it's the honeypot with no trap just honey and I wanted to see if anybody was scanning binary-only contracts and attacking them and the answer is yes this happened about a day after I put the contract up on main net and for an example that's not me here's an old contract it turns out to be a open source like dungeon style navigation game but they copy and pasted some code and removed the only owner check on mortal so somebody called it and got three eath so this is just a quick overview of what I was doing the summer and it turns out only a small fraction of contracts have been destroyed when they had value so I'm looking for other heuristics to apply and if you have any questions or are curious about this kind of analysis I'll be happy to chat outside and thank you for your attention