Posted on

Talk @ EthCC 2019: Let’s dig inside Ethereum Smart Contracts compiled to WebAssembly

Ethereum ETHCC Paris reverse webassembly patrick ventuzelo analysis smart contract Parity Kovan mainnet testnet conference talk

2019/02/18 @ EthCC 2019

At Devcon4, Vitalik annonced that WebAssembly (wasm) will be part of Ethereum 2.0 (Serenity). It’s already possible to compile smart contracts to wasm modules and run them in the Kovan network.

Using WebAssembly smart contract doesn’t mean using secure smart contract.

In this talk, I will explain what’s inside a WebAssembly module and illustrate how to analyze wasm Ethereum smart contracts to find vulnerabilities and unoptimization.

  1. Introduction
  2. WebAssembly basics
  3. Program analysis
  4. Parity Helloworld
  5. WASM module Vulnerabilities
  6. Conclusion

link / slides / video

Posted on

Workshop @ BlackAlps 2018: Reversing and Vulnerability research of Ethereum Smart Contracts

blackalps 2018 ethereum reverse vulnerability research octopus patrick ventuzelo smart contract evm ethereum ETH EVM workshop

2018/11/08 @ BlackAlps 2018

Ethereum is the reference of smart contract platform due to the possibility to create decentralized applications (Dapps) by writing smart contracts. The Solidity source code of those smart contracts are not always available and can contains flaws (reentrancy, integer overflow/underflow, bad randomness, backdoor, ….). Some smart contract handle thousand of ETH and can’t be modified once pushed into the blockchain. More than 90% of them doesn’t provide the associated Solidity source code and that’s also why be able to reverse and analyze Ethereum smart contract (only with the EVM bytecode) make even more sense.

This workshop is intended to bring attendees the basic skills (theoretical and practical) to analyze Ethereum smart contracts. After the workshop, they will be able to reverse, debug and find basic vulnerabilities into real-life smart contracts without having the Solidity source code.

The following points will be covered in the workshop:

  1. Quick introduction of Ethereum
  2. Basic Ethereum testing lab
  3. Reverse engineering of Ethereum smart contracts
  4. Analysis and vulnerability research
  5. Going deeper & Questions

link / slides / video

Posted on

Talk @ Devcon 4 – 2018: Reversing Ethereum Smart Contracts to find out what’s behind EVM bytecode

devcon iv ethereum patrick ventuzelo reverse evm octopus cfg analysis smart contract vulnerability research ocptimization talk

2018/11/01 @ Devcon iv.

Reverse engineering is a common technique used by security researcher to understand and analyze the behavior of closed-source binaries.

If you apply this to Ethereum smart contract (and more specifically on the EVM bytecode), thats allow you to analyze and verify the result of your Solidity source code compilation. 

From a developer point of view, it can save you a lot of time and money if you succeed to detect flaws and missing bytecode optimization.

Also, providing the Solidity source code it’s not mandatory during the smart contract creation, that’s why being able to directly reverse the EVM bytecode make even more sense if you want to understand the behavior of external smart contracts.

slides / video

Posted on

Workshop @ hack.lu 2018: Reversing and Vulnerability research of Ethereum Smart Contracts

hacklu 2018 ethereum reverse vulnerability octopus patrick ventuzelo smart contract evm ethereum ETH

2018/10/18 @ hack.lu 2018

This workshop is intended to bring attendees the basic skills (theoretical and practical) to analyze Ethereum smart contracts. After the workshop, they will be able to reverse, debug and find basic vulnerabilities into real-life smart contracts without having the Solidity source code.

The following points will be covered in the workshop:

  1. Quick introduction of Ethereum
  2. Basic Ethereum testing lab
  3. Reverse engineering of Ethereum smart contracts
  4. Analysis and vulnerability research
  5. Going deeper & Questions

link / slides