Hi everyone,



This week I've decided to open with the tools section, because I can.

Tools

Eveem uses symbolic execution to extract a human readable representation of the code from bytecode. The tool isn’t yet open sourced, but you can put in the address of any contract on the mainnet, and the website will show you the result of decompilation. The output looks like a mix of python and solidity.

A couple of interesting chat discussions emerged around Eveem. Namely, why do we need a decompiler? If the source code of a contract isn’t available, then why would anyone interact with it in a way that requires trust?



One answer: even if the source code is known, decompilation techniques could provide an intermediate representation for security analysis. But it would be presumably be better to derive that IR from the source code.

Another answer: demonstrating the futility of trying to hide obscure code stored on the blockchain. For example, the Crypto Kitties genetic algorithm was meant to be obscured, but this article nicely describes how to reverse engineer it. If you’d like to delve into the topic further, this paper is a good start: Erays: Reverse Engineering Ethereum’s Opaque Smart Contracts.

Smart contract auditing human vs machine

CoinFabrik compares seven different tools on their ability to detect the common types of bugs using examples found in the SWC registry. The tools looked at are Manticore, Mythril, Oyente, SmartCheck, Solhint, Solium, Sonar Solidity.

Finding Vulnerabilities in Smart Contracts (with “Harvey”)

Valentin Wüstholz of Mythril/Diligence explains fuzzing, describes some of the different approaches used for fuzzing, and how his new tool ‘Harvey’ fits into the paradigm

News

Hackers ramp up attacks on mining rigs

Hackers have initiated a large scale scan for mining rigs and ethereum wallets with exposed 8545 ports. This is the standard port for the JSON-RPC interface of many Ethereum wallets and mining equipment, and if exposed it can allow ether theft. Such scans are not new but have tripled since last month.

A presentation on Non-Interactive Proofs of Proof-of-Work used to facilitate sidechains. It develops a mathematical basis to prove various security properties of the proof structure which allow sidechains to function.

Nick Tomaino on the Semantic interpretation for resolution of an Augur prediction market

A twitter thread describing a disputed prediction: “Which party will control the House after 2018 U.S. mid-term election?”. Nick points out that imprecise wording leaves room for subjective interpretation of the results, which is not what you want in a prediction market. (Disclaimer: I couldn’t find the market he was talking about, but even as a hypothetical it’s interesting). The thread is not exactly security related, but it feels very relevant given the need to be precise and correct in the specification of a contract.

--------



If you’ve reached the end of this newsletter and want more technical news, my friend Ben Edgington has taken to publishing weekly summaries of changes in research: What's New in Eth2.

Thanks for reading,Maurelian

---------

This newsletter is supported by ConsenSys Diligence. We can help with all things smart contract security; auditing, SDLC guidance, and training in secure smart contract development. Just reply to this email.