Birthmarking Your Smart Contracts For Vulnerability Search by Han Liu (Devcon5)

Fri, Oct 2, 2020, 12:00 AM

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more. https://archive.devcon.org/archive/watch/5/birthmarking-your-smart-contracts-for-vulnerability-search In this talk, we will highlight an automatic vulnerability search technique for smart contracts. In the context of security, vulnerability search enables us to make quick response to new threats and zero-day exploits. In those cases, well-designed analysis is far from prepared to deliever precise detections. Our vulnerability search technique can act as a complement in this setting to efficiently identify potentially vulnerable contracts without heavyweight in-depth reasoning and analysis.The key insight is to "birthmarking" a smart contract by abstracting its programming intents. Generally, the generation of birthmarks is realized via symbolically executing the bytecode of a smart contract and building global dependency on the fly. More specifically, both syntax features (e.g., number and type of instructions) and semantic features (e.g., load and store at the same storage) are considered in birthmarks. Then, the task of searching for a known vulnerability is converted to computing a similarity between a target contract (with the vulnerability) and a candidate contract (may/may not have the vulnerability). We have implemented a prototype to search for known vulnerabilities and conducted large-scale evaluations on real-world security issues. Particularly, we will use CVE­-2018-­10376 to explain how the search technique can help existing security analyzers Speaker(s): Han Liu, Qian Ren, Zhiqiang Yang Skill level: Intermediate Track: Developer Infrastructure Keywords: technical Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum Learn more about devcon: https://www.devcon.org/ Learn more about ethereum: https://ethereum.org/ Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019. Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/