diff --git a/SemSEpresentation/slides.pdf b/SemSEpresentation/slides.pdf index 4b04574..ba51e6c 100644 Binary files a/SemSEpresentation/slides.pdf and b/SemSEpresentation/slides.pdf differ diff --git a/SemSEpresentation/slides.tex b/SemSEpresentation/slides.tex index a8d7e7c..587412a 100644 --- a/SemSEpresentation/slides.tex +++ b/SemSEpresentation/slides.tex @@ -117,15 +117,17 @@ pragma solidity 0.4.25; contract MyContract { - uint[] private arr; - - constructor() public { - arr = new uint[](0); - } - - function write(unit index, uint value) { - arr[index] = value; - } + address private owner; + uint[] private arr; + + constructor() public { + arr = new uint[](0); + owner = msg.sender; + } + + function write(unit index, uint value) { + arr[index] = value; + } } \end{lstlisting} \end{frame} @@ -192,6 +194,15 @@ contract MyContract { \end{lstlisting} \end{frame} +\begin{frame}[fragile] + \frametitle{Why this works} + A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$. + + For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$. + + An attacker can use this information to overwrite any storage slot by finding an appropriate offset value. +\end{frame} + \section{Detecting and Exploiting} \subsection[Detecting SWC-124]{Detecting SWC-124} \begin{frame}[fragile] diff --git a/SemSEreport/exercises.pdf b/SemSEreport/report.pdf similarity index 91% rename from SemSEreport/exercises.pdf rename to SemSEreport/report.pdf index 4b0efbc..77fb77b 100644 Binary files a/SemSEreport/exercises.pdf and b/SemSEreport/report.pdf differ