Pentesting Ethereum Contracts: Exploring a Honeypot Contract Using Ganache (Devcon5)

Fri, Oct 2, 2020, 12:00 AM

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more. https://archive.devcon.org/archive/watch/5/pentesting-ethereum-contracts-exploring-a-honeypot-contract-using-ganache In this workshop we will demonstrate some of Ganache's advanced features to instantly fork Ethereum Mainnet, granting developers a safe, secure, and risk-free environment. We'll explore what a re-entrancy attack is, review historical re-entrancy attacks (like the DAO hack), as well as the narrowly avoided re-entrancy attack vector that would have been introduced by the original Constantinople hardfork proposal. Attendees will attempt to perform a re-entrancy attack against an actual Mainnet-deployed contract that has been cleverly crafted to trick aspiring exploiters into becoming victims. We will utilize Ganache's forking feature to safely discover how it works, and how to write better — and more secure — contracts. At the end of the workshop we'll play a game of Capture the Flag, where you'll have a chance to exploit a real contract, earning actual Mainnet Ether if you are the the first to execute the exploit! But you'll have to be careful as things aren't always as they seem! Ganache is a fast, lightweight development blockchain, and is part of the Truffle tool suite. Ganache forking is a feature that enables developers to read from Mainnet, while transacting against a local development chain, enabling fast, sync-free development and penetration testing. Speaker(s): David Murdoch, Nick Paterno Skill level: Intermediate Track: Security Keywords: technical Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum Learn more about devcon: https://www.devcon.org/ Learn more about ethereum: https://ethereum.org/ Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019. Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/