add paper template

This commit is contained in:
nitowa
2023-10-23 20:06:46 +02:00
parent d322ce79b0
commit bd51871e95
8 changed files with 919 additions and 0 deletions
+58
View File
@@ -0,0 +1,58 @@
@INPROCEEDINGS{9678888,
author={Choi, Jaeseung and Kim, Doyeon and Kim, Soomin and Grieco, Gustavo and Groce, Alex and Cha, Sang Kil},
booktitle={2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)},
title={SMARTIAN: Enhancing Smart Contract Fuzzing with Static and Dynamic Data-Flow Analyses},
year={2021},
volume={},
number={},
pages={227-239},
doi={10.1109/ASE51524.2021.9678888}}
@inproceedings{10.1145/3578527.3578538,
author = {Pani, Siddhasagar and Nallagonda, Harshita Vani and Vigneswaran and Medicherla, Raveendra Kumar and Rajan M},
title = {SmartFuzzDriverGen: Smart Contract Fuzzing Automation for Golang},
year = {2023},
isbn = {9798400700644},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3578527.3578538},
doi = {10.1145/3578527.3578538},
abstract = {Greybox fuzzers require intermediate programs called fuzz drivers to test smart contract APIs. These fuzz drivers use the semi-random inputs (bytes) generated by fuzzers to prepare suitable inputs required to test APIs. Further, fuzz driver also uses this input to decide sequence in which APIs to be invoked and enables the fuzzer to execute the APIs in that sequence to find the vulnerabilities, if any. Manually writing such complex and intelligent fuzz drivers is laborious, requires deep technical skills, hence can be cumbersome and error prone. In this paper, we propose SmartFuzzDriverGen framework to automatically generate fuzz drivers which invoke smart contract APIs using different strategies: unit-level, sequence-based (random, user-defined), and heuristics based. We evaluate the proposed framework by testing a prototype implementation of it with Golang smart contracts (targeted for Hyperledger Fabric platform) and study the effectiveness of the generated fuzz drivers in terms of code coverage as well as bug finding abilities. We observed that fuzzing of APIs in random sequences performed better than the other methods.},
booktitle = {Proceedings of the 16th Innovations in Software Engineering Conference},
articleno = {14},
numpages = {11},
keywords = {smart contracts, vulnerability detection, automated driver generation, blockchain, fuzzing, sequencing},
location = {Allahabad, India},
series = {ISEC '23}
}
@inproceedings {217464,
author = {Johannes Krupp and Christian Rossow},
title = {{teEther}: Gnawing at Ethereum to Automatically Exploit Smart Contracts},
booktitle = {27th USENIX Security Symposium (USENIX Security 18)},
year = {2018},
isbn = {978-1-939133-04-5},
address = {Baltimore, MD},
pages = {1317--1333},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/krupp},
publisher = {USENIX Association},
month = aug
}
@inproceedings{10.1145/3243734.3243780,
author = {Tsankov, Petar and Dan, Andrei and Drachsler-Cohen, Dana and Gervais, Arthur and B\"{u}nzli, Florian and Vechev, Martin},
title = {Securify: Practical Security Analysis of Smart Contracts},
year = {2018},
isbn = {9781450356930},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3243734.3243780},
doi = {10.1145/3243734.3243780},
abstract = {Permissionless blockchains allow the execution of arbitrary programs (called smart contracts), enabling mutually untrusted entities to interact without relying on trusted third parties. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts. To address this problem, we present Securify, a security analyzer for Ethereum smart contracts that is scalable, fully automated, and able to prove contract behaviors as safe/unsafe with respect to a given property. Securify's analysis consists of two steps. First, it symbolically analyzes the contract's dependency graph to extract precise semantic information from the code. Then, it checks compliance and violation patterns that capture sufficient conditions for proving if a property holds or not. To enable extensibility, all patterns are specified in a designated domain-specific language. Securify is publicly released, it has analyzed >18K contracts submitted by its users, and is regularly used to conduct security audits by experts. We present an extensive evaluation of Securify over real-world Ethereum smart contracts and demonstrate that it can effectively prove the correctness of smart contracts and discover critical violations.},
booktitle = {Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security},
pages = {6782},
numpages = {16},
keywords = {smart contracts, stratified datalog, verification, security analysis},
location = {Toronto, Canada},
series = {CCS '18}
}
+21
View File
@@ -0,0 +1,21 @@
\relax
\bibstyle{plain}
\providecommand \oddpage@label [2]{}
\@writefile{toc}{\contentsline {section}{\numberline {1}Weakness and consequences}{1}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {1.1}Solidity storage layout}{1}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {1.2}The Weakness}{1}{}\protected@file@percent }
\@writefile{loa}{\contentsline {algocf}{\numberline {1}{\ignorespaces A completely unchecked array write}}{1}{}\protected@file@percent }
\newlabel{alg:agf-opt-merge}{{1}{1}}
\citation{10.1145/3243734.3243780}
\citation{10.1145/3578527.3578538}
\citation{217464}
\citation{9678888}
\bibdata{exercise.bib}
\bibcite{9678888}{1}
\bibcite{217464}{2}
\bibcite{10.1145/3578527.3578538}{3}
\bibcite{10.1145/3243734.3243780}{4}
\@writefile{toc}{\contentsline {section}{\numberline {2}Vulnerable contracts in literature}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}Code properties and automatic detection}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Exploit sketch}{2}{}\protected@file@percent }
\gdef \@abspage@last{2}
+34
View File
@@ -0,0 +1,34 @@
\begin{thebibliography}{1}
\bibitem{9678888}
Jaeseung Choi, Doyeon Kim, Soomin Kim, Gustavo Grieco, Alex Groce, and Sang~Kil
Cha.
\newblock Smartian: Enhancing smart contract fuzzing with static and dynamic
data-flow analyses.
\newblock In {\em 2021 36th IEEE/ACM International Conference on Automated
Software Engineering (ASE)}, pages 227--239, 2021.
\bibitem{217464}
Johannes Krupp and Christian Rossow.
\newblock {teEther}: Gnawing at ethereum to automatically exploit smart
contracts.
\newblock In {\em 27th USENIX Security Symposium (USENIX Security 18)}, pages
1317--1333, Baltimore, MD, August 2018. USENIX Association.
\bibitem{10.1145/3578527.3578538}
Siddhasagar Pani, Harshita~Vani Nallagonda, Vigneswaran, Raveendra~Kumar
Medicherla, and Rajan M.
\newblock Smartfuzzdrivergen: Smart contract fuzzing automation for golang.
\newblock In {\em Proceedings of the 16th Innovations in Software Engineering
Conference}, ISEC '23, New York, NY, USA, 2023. Association for Computing
Machinery.
\bibitem{10.1145/3243734.3243780}
Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian
B\"{u}nzli, and Martin Vechev.
\newblock Securify: Practical security analysis of smart contracts.
\newblock In {\em Proceedings of the 2018 ACM SIGSAC Conference on Computer and
Communications Security}, CCS '18, page 6782, New York, NY, USA, 2018.
Association for Computing Machinery.
\end{thebibliography}
+48
View File
@@ -0,0 +1,48 @@
This is BibTeX, Version 0.99d
Capacity: max_strings=200000, hash_size=200000, hash_prime=170003
The top-level auxiliary file: exercises.aux
Reallocating 'name_of_file' (item size: 1) to 6 items.
The style file: plain.bst
Reallocating 'name_of_file' (item size: 1) to 13 items.
Database file #1: exercise.bib
You've used 4 entries,
2118 wiz_defined-function locations,
525 strings with 5122 characters,
and the built_in function-call counts, 2044 in all, are:
= -- 206
> -- 107
< -- 3
+ -- 42
- -- 38
* -- 137
:= -- 313
add.period$ -- 15
call.type$ -- 4
change.case$ -- 31
chr.to.int$ -- 0
cite$ -- 4
duplicate$ -- 91
empty$ -- 144
format.name$ -- 38
if$ -- 458
int.to.chr$ -- 0
int.to.str$ -- 4
missing$ -- 4
newline$ -- 23
num.names$ -- 8
pop$ -- 38
preamble$ -- 1
purify$ -- 27
quote$ -- 0
skip$ -- 75
stack$ -- 0
substring$ -- 102
swap$ -- 40
text.length$ -- 3
text.prefix$ -- 0
top$ -- 0
type$ -- 16
warning$ -- 0
while$ -- 14
width$ -- 5
write$ -- 53
+624
View File
@@ -0,0 +1,624 @@
This is pdfTeX, Version 3.141592653-2.6-1.40.25 (MiKTeX 23.5) (preloaded format=pdflatex 2023.6.4) 23 OCT 2023 19:58
entering extended mode
restricted \write18 enabled.
%&-line parsing enabled.
**./exercises.tex
(exercises.tex
LaTeX2e <2022-11-01> patch level 1
L3 programming layer <2023-05-15>
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/base\article.cls
Document Class: article 2022/07/02 v1.4n Standard LaTeX document class
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/base\size10.clo
File: size10.clo 2022/07/02 v1.4n Standard LaTeX file (size option)
)
\c@part=\count185
\c@section=\count186
\c@subsection=\count187
\c@subsubsection=\count188
\c@paragraph=\count189
\c@subparagraph=\count190
\c@figure=\count191
\c@table=\count192
\abovecaptionskip=\skip48
\belowcaptionskip=\skip49
\bibindent=\dimen140
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/base\latexsym.sty
Package: latexsym 1998/08/17 v2.2e Standard LaTeX package (lasy symbols)
\symlasy=\mathgroup4
LaTeX Font Info: Overwriting symbol font `lasy' in version `bold'
(Font) U/lasy/m/n --> U/lasy/b/n on input line 52.
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/amsfonts\amssymb.sty
Package: amssymb 2013/01/14 v3.01 AMS font symbols
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/amsfonts\amsfonts.sty
Package: amsfonts 2013/01/14 v3.01 Basic AMSFonts support
\@emptytoks=\toks16
\symAMSa=\mathgroup5
\symAMSb=\mathgroup6
LaTeX Font Info: Redeclaring math symbol \hbar on input line 98.
LaTeX Font Info: Overwriting math alphabet `\mathfrak' in version `bold'
(Font) U/euf/m/n --> U/euf/b/n on input line 106.
)) (d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics\epsfig.sty
Package: epsfig 2017/06/25 v1.7b (e)psfig emulation (SPQR)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics\graphicx.sty
Package: graphicx 2021/09/16 v1.2d Enhanced LaTeX Graphics (DPC,SPQR)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics\keyval.sty
Package: keyval 2022/05/29 v1.15 key=value parser (DPC)
\KV@toks@=\toks17
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics\graphics.sty
Package: graphics 2022/03/10 v1.4e Standard LaTeX Graphics (DPC,SPQR)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics\trig.sty
Package: trig 2021/08/11 v1.11 sin cos tan (DPC)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics-cfg\graphics.
cfg
File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration
)
Package graphics Info: Driver file: pdftex.def on input line 107.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics-def\pdftex.de
f
File: pdftex.def 2022/09/22 v1.2b Graphics/color driver for pdftex
))
\Gin@req@height=\dimen141
\Gin@req@width=\dimen142
)
\epsfxsize=\dimen143
\epsfysize=\dimen144
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/preprint\fullpage.sty
Package: fullpage 1999/02/23 1.1 (PWD)
\FP@margin=\skip50
) (d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/tools\enumerate.sty
Package: enumerate 2015/07/23 v3.00 enumerate extensions (DPC)
\@enLab=\toks18
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/tools\xspace.sty
Package: xspace 2014/10/28 v1.13 Space after command names (DPC,MH)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/todonotes\todonotes.st
y
Package: todonotes 2023/01/31 v1.1.6 Todonotes source and documentation.
Package: todonotes 2023/01/31
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/base\ifthen.sty
Package: ifthen 2022/04/13 v1.1d Standard LaTeX ifthen package (DPC)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/xkeyval\xkeyval.sty
Package: xkeyval 2022/06/16 v2.9 package option processing (HA)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/xkeyval\xkeyval.tex
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/xkeyval\xkvutils.tex
\XKV@toks=\toks19
\XKV@tempa@toks=\toks20
)
\XKV@depth=\count193
File: xkeyval.tex 2014/12/03 v2.7a key=value parser (HA)
)) (d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/xcolor\xcolor.sty
Package: xcolor 2022/06/12 v2.14 LaTeX color extensions (UK)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics-cfg\color.cfg
File: color.cfg 2016/01/02 v1.6 sample color configuration
)
Package xcolor Info: Driver file: pdftex.def on input line 227.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/graphics\mathcolor.ltx
)
Package xcolor Info: Model `cmy' substituted by `cmy0' on input line 1353.
Package xcolor Info: Model `hsb' substituted by `rgb' on input line 1357.
Package xcolor Info: Model `RGB' extended on input line 1369.
Package xcolor Info: Model `HTML' substituted by `rgb' on input line 1371.
Package xcolor Info: Model `Hsb' substituted by `hsb' on input line 1372.
Package xcolor Info: Model `tHsb' substituted by `hsb' on input line 1373.
Package xcolor Info: Model `HSB' substituted by `hsb' on input line 1374.
Package xcolor Info: Model `Gray' substituted by `gray' on input line 1375.
Package xcolor Info: Model `wave' substituted by `hsb' on input line 1376.
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/frontendlayer\tikz
.sty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/basiclayer\pgf.sty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/utilities\pgfrcs.s
ty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgfuti
l-common.tex
\pgfutil@everybye=\toks21
\pgfutil@tempdima=\dimen145
\pgfutil@tempdimb=\dimen146
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgfuti
l-latex.def
\pgfutil@abb=\box51
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgfrcs
.code.tex
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf\pgf.revision.tex
)
Package: pgfrcs 2023-01-15 v3.1.10 (3.1.10)
))
Package: pgf 2023-01-15 v3.1.10 (3.1.10)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/basiclayer\pgfcore
.sty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/systemlayer\pgfsys
.sty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/systemlayer\pgfs
ys.code.tex
Package: pgfsys 2023-01-15 v3.1.10 (3.1.10)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgfkey
s.code.tex
\pgfkeys@pathtoks=\toks22
\pgfkeys@temptoks=\toks23
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgfkey
slibraryfiltered.code.tex
\pgfkeys@tmptoks=\toks24
))
\pgf@x=\dimen147
\pgf@y=\dimen148
\pgf@xa=\dimen149
\pgf@ya=\dimen150
\pgf@xb=\dimen151
\pgf@yb=\dimen152
\pgf@xc=\dimen153
\pgf@yc=\dimen154
\pgf@xd=\dimen155
\pgf@yd=\dimen156
\w@pgf@writea=\write3
\r@pgf@reada=\read2
\c@pgf@counta=\count194
\c@pgf@countb=\count195
\c@pgf@countc=\count196
\c@pgf@countd=\count197
\t@pgf@toka=\toks25
\t@pgf@tokb=\toks26
\t@pgf@tokc=\toks27
\pgf@sys@id@count=\count198
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/systemlayer\pgf.
cfg
File: pgf.cfg 2023-01-15 v3.1.10 (3.1.10)
)
Driver file for pgf: pgfsys-pdftex.def
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/systemlayer\pgfs
ys-pdftex.def
File: pgfsys-pdftex.def 2023-01-15 v3.1.10 (3.1.10)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/systemlayer\pgfs
ys-common-pdf.def
File: pgfsys-common-pdf.def 2023-01-15 v3.1.10 (3.1.10)
)))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/systemlayer\pgfs
yssoftpath.code.tex
File: pgfsyssoftpath.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgfsyssoftpath@smallbuffer@items=\count199
\pgfsyssoftpath@bigbuffer@items=\count266
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/systemlayer\pgfs
ysprotocol.code.tex
File: pgfsysprotocol.code.tex 2023-01-15 v3.1.10 (3.1.10)
))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
re.code.tex
Package: pgfcore 2023-01-15 v3.1.10 (3.1.10)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmath.cod
e.tex
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathutil
.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathpars
er.code.tex
\pgfmath@dimen=\dimen157
\pgfmath@count=\count267
\pgfmath@box=\box52
\pgfmath@toks=\toks28
\pgfmath@stack@operand=\toks29
\pgfmath@stack@operation=\toks30
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.basic.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.trigonometric.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.random.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.comparison.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.base.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.round.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.misc.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfunc
tions.integerarithmetics.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathcalc
.code.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmathfloa
t.code.tex
\c@pgfmathroundto@lastzeros=\count268
))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfint.code
.tex)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
repoints.code.tex
File: pgfcorepoints.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgf@picminx=\dimen158
\pgf@picmaxx=\dimen159
\pgf@picminy=\dimen160
\pgf@picmaxy=\dimen161
\pgf@pathminx=\dimen162
\pgf@pathmaxx=\dimen163
\pgf@pathminy=\dimen164
\pgf@pathmaxy=\dimen165
\pgf@xx=\dimen166
\pgf@xy=\dimen167
\pgf@yx=\dimen168
\pgf@yy=\dimen169
\pgf@zx=\dimen170
\pgf@zy=\dimen171
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
repathconstruct.code.tex
File: pgfcorepathconstruct.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgf@path@lastx=\dimen172
\pgf@path@lasty=\dimen173
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
repathusage.code.tex
File: pgfcorepathusage.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgf@shorten@end@additional=\dimen174
\pgf@shorten@start@additional=\dimen175
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
rescopes.code.tex
File: pgfcorescopes.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgfpic=\box53
\pgf@hbox=\box54
\pgf@layerbox@main=\box55
\pgf@picture@serial@count=\count269
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
regraphicstate.code.tex
File: pgfcoregraphicstate.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgflinewidth=\dimen176
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
retransformations.code.tex
File: pgfcoretransformations.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgf@pt@x=\dimen177
\pgf@pt@y=\dimen178
\pgf@pt@temp=\dimen179
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
requick.code.tex
File: pgfcorequick.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
reobjects.code.tex
File: pgfcoreobjects.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
repathprocessing.code.tex
File: pgfcorepathprocessing.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
rearrows.code.tex
File: pgfcorearrows.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgfarrowsep=\dimen180
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
reshade.code.tex
File: pgfcoreshade.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgf@max=\dimen181
\pgf@sys@shading@range@num=\count270
\pgf@shadingcount=\count271
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
reimage.code.tex
File: pgfcoreimage.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
reexternal.code.tex
File: pgfcoreexternal.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgfexternal@startupbox=\box56
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
relayers.code.tex
File: pgfcorelayers.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
retransparency.code.tex
File: pgfcoretransparency.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
repatterns.code.tex
File: pgfcorepatterns.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/basiclayer\pgfco
rerdf.code.tex
File: pgfcorerdf.code.tex 2023-01-15 v3.1.10 (3.1.10)
)))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/modules\pgfmodul
eshapes.code.tex
File: pgfmoduleshapes.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgfnodeparttextbox=\box57
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/modules\pgfmodul
eplot.code.tex
File: pgfmoduleplot.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/compatibility\pgfc
omp-version-0-65.sty
Package: pgfcomp-version-0-65 2023-01-15 v3.1.10 (3.1.10)
\pgf@nodesepstart=\dimen182
\pgf@nodesepend=\dimen183
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/compatibility\pgfc
omp-version-1-18.sty
Package: pgfcomp-version-1-18 2023-01-15 v3.1.10 (3.1.10)
))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/utilities\pgffor.s
ty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/utilities\pgfkeys.
sty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgfkey
s.code.tex))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/pgf/math\pgfmath.sty
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/math\pgfmath.cod
e.tex))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/utilities\pgffor
.code.tex
Package: pgffor 2023-01-15 v3.1.10 (3.1.10)
\pgffor@iter=\dimen184
\pgffor@skip=\dimen185
\pgffor@stack=\toks31
\pgffor@toks=\toks32
))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/frontendlayer/ti
kz\tikz.code.tex
Package: tikz 2023-01-15 v3.1.10 (3.1.10)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/libraries\pgflib
raryplothandlers.code.tex
File: pgflibraryplothandlers.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgf@plot@mark@count=\count272
\pgfplotmarksize=\dimen186
)
\tikz@lastx=\dimen187
\tikz@lasty=\dimen188
\tikz@lastxsaved=\dimen189
\tikz@lastysaved=\dimen190
\tikz@lastmovetox=\dimen191
\tikz@lastmovetoy=\dimen192
\tikzleveldistance=\dimen193
\tikzsiblingdistance=\dimen194
\tikz@figbox=\box58
\tikz@figbox@bg=\box59
\tikz@tempbox=\box60
\tikz@tempbox@bg=\box61
\tikztreelevel=\count273
\tikznumberofchildren=\count274
\tikznumberofcurrentchild=\count275
\tikz@fig@count=\count276
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/modules\pgfmodul
ematrix.code.tex
File: pgfmodulematrix.code.tex 2023-01-15 v3.1.10 (3.1.10)
\pgfmatrixcurrentrow=\count277
\pgfmatrixcurrentcolumn=\count278
\pgf@matrix@numberofcolumns=\count279
)
\tikz@expandcount=\count280
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/frontendlayer/ti
kz/libraries\tikzlibrarytopaths.code.tex
File: tikzlibrarytopaths.code.tex 2023-01-15 v3.1.10 (3.1.10)
)))
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/generic/pgf/frontendlayer/ti
kz/libraries\tikzlibrarypositioning.code.tex
File: tikzlibrarypositioning.code.tex 2023-01-15 v3.1.10 (3.1.10)
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/tools\calc.sty
Package: calc 2017/05/25 v4.3 Infix arithmetic (KKT,FJ)
\calc@Acount=\count281
\calc@Bcount=\count282
\calc@Adimen=\dimen195
\calc@Bdimen=\dimen196
\calc@Askip=\skip51
\calc@Bskip=\skip52
LaTeX Info: Redefining \setlength on input line 80.
LaTeX Info: Redefining \addtolength on input line 81.
\calc@Ccount=\count283
\calc@Cskip=\skip53
)
\c@@todonotes@numberoftodonotes=\count284
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/listings\listings.sty
\lst@mode=\count285
\lst@gtempboxa=\box62
\lst@token=\toks33
\lst@length=\count286
\lst@currlwidth=\dimen197
\lst@column=\count287
\lst@pos=\count288
\lst@lostspace=\dimen198
\lst@width=\dimen199
\lst@newlines=\count289
\lst@lineno=\count290
\lst@maxwidth=\dimen256
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/listings\lstmisc.sty
File: lstmisc.sty 2023/02/27 1.9 (Carsten Heinz)
\c@lstnumber=\count291
\lst@skipnumbers=\count292
\lst@framebox=\box63
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/listings\listings.cfg
File: listings.cfg 2023/02/27 1.9 listings configuration
))
Package: listings 2023/02/27 1.9 (Carsten Heinz)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/algorithm2e\algorithm2
e.sty
Package: algorithm2e 2017/07/18 v5.2 algorithms environments
\c@AlgoLine=\count293
\algocf@hangindent=\skip54
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/ifoddpage\ifoddpage.st
y
Package: ifoddpage 2022/10/18 v1.2 Conditionals for odd/even page detection
\c@checkoddpage=\count294
) (d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/relsize\relsize.sty
Package: relsize 2013/03/29 ver 4.1
)
\skiptotal=\skip55
\skiplinenumber=\skip56
\skiprule=\skip57
\skiphlne=\skip58
\skiptext=\skip59
\skiplength=\skip60
\algomargin=\skip61
\skipalgocfslide=\skip62
\algowidth=\dimen257
\inoutsize=\dimen258
\inoutindent=\dimen259
\interspacetitleruled=\dimen260
\interspacealgoruled=\dimen261
\interspacetitleboxruled=\dimen262
\algocf@ruledwidth=\skip63
\algocf@inoutbox=\box64
\algocf@inputbox=\box65
\AlCapSkip=\skip64
\AlCapHSkip=\skip65
\algoskipindent=\skip66
\algocf@nlbox=\box66
\algocf@hangingbox=\box67
\algocf@untilbox=\box68
\algocf@skipuntil=\skip67
\algocf@capbox=\box69
\algocf@lcaptionbox=\skip68
\algoheightruledefault=\skip69
\algoheightrule=\skip70
\algotitleheightruledefault=\skip71
\algotitleheightrule=\skip72
\c@algocfline=\count295
\c@algocfproc=\count296
\c@algocf=\count297
\algocf@algoframe=\box70
\algocf@algobox=\box71
)
\c@theorem=\count298
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/l3backend\l3backend-pd
ftex.def
File: l3backend-pdftex.def 2023-04-19 L3 backend support: PDF output (pdfTeX)
\l__color_backend_stack_int=\count299
\l__pdf_internal_box=\box72
) (exercises.aux)
\openout1 = `exercises.aux'.
LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 69.
LaTeX Font Info: ... okay on input line 69.
LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 69.
LaTeX Font Info: ... okay on input line 69.
LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 69.
LaTeX Font Info: ... okay on input line 69.
LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 69.
LaTeX Font Info: ... okay on input line 69.
LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 69.
LaTeX Font Info: ... okay on input line 69.
LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 69.
LaTeX Font Info: ... okay on input line 69.
LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 69.
LaTeX Font Info: ... okay on input line 69.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/context/base/mkii\supp-pdf.m
kii
[Loading MPS to PDF converter (version 2006.09.02).]
\scratchcounter=\count300
\scratchdimen=\dimen263
\scratchbox=\box73
\nofMPsegments=\count301
\nofMParguments=\count302
\everyMPshowfont=\toks34
\MPscratchCnt=\count303
\MPscratchDim=\dimen264
\MPnumerator=\count304
\makeMPintoPDFobject=\count305
\everyMPtoPDFconversion=\toks35
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/epstopdf-pkg\epstopdf-
base.sty
Package: epstopdf-base 2020-01-24 v2.11 Base part for package epstopdf
Package epstopdf-base Info: Redefining graphics rule for `.eps' on input line 4
85.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/00miktex\epstopdf-sys.
cfg
File: epstopdf-sys.cfg 2021/03/18 v2.0 Configuration of epstopdf for MiKTeX
))
\c@lstlisting=\count306
LaTeX Font Info: Trying to load font information for U+lasy on input line 72
.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/base\ulasy.fd
File: ulasy.fd 1998/08/17 v2.2e LaTeX symbol font definitions
)
LaTeX Font Info: Trying to load font information for U+msa on input line 72.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/amsfonts\umsa.fd
File: umsa.fd 2013/01/14 v3.01 AMS symbols A
)
LaTeX Font Info: Trying to load font information for U+msb on input line 72.
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/amsfonts\umsb.fd
File: umsb.fd 2013/01/14 v3.01 AMS symbols B
)
(d:\Users\Forest\AppData\Local\Programs\MiKTeX\tex/latex/listings\lstlang1.sty
File: lstlang1.sty 2023/02/27 1.9 listings language file
)
Overfull \hbox (15.0pt too wide) detected at line 108
[][]
[]
[1
{C:/Users/Forest/AppData/Local/MiKTeX/fonts/map/pdftex/pdftex.map}]
(exercises.bbl) [2] (exercises.aux) )
Here is how much of TeX's memory you used:
16499 strings out of 476410
322428 string characters out of 5788642
1897845 words of memory out of 5000000
36581 multiletter control sequences out of 15000+600000
521468 words of font info for 72 fonts, out of 8000000 for 9000
1141 hyphenation exceptions out of 8191
99i,9n,94p,442b,2016s stack positions out of 10000i,1000n,20000p,200000b,200000s
<d:/Users/Forest/AppData/Local/Programs/Mi
KTeX/fonts/type1/public/amsfonts/cm/cmbx10.pfb><d:/Users/Forest/AppData/Local/P
rograms/MiKTeX/fonts/type1/public/amsfonts/cm/cmbx12.pfb><d:/Users/Forest/AppDa
ta/Local/Programs/MiKTeX/fonts/type1/public/amsfonts/cm/cmmi10.pfb><d:/Users/Fo
rest/AppData/Local/Programs/MiKTeX/fonts/type1/public/amsfonts/cm/cmr10.pfb><d:
/Users/Forest/AppData/Local/Programs/MiKTeX/fonts/type1/public/amsfonts/cm/cmr1
2.pfb><d:/Users/Forest/AppData/Local/Programs/MiKTeX/fonts/type1/public/amsfont
s/cm/cmr17.pfb><d:/Users/Forest/AppData/Local/Programs/MiKTeX/fonts/type1/publi
c/amsfonts/cm/cmr5.pfb><d:/Users/Forest/AppData/Local/Programs/MiKTeX/fonts/typ
e1/public/amsfonts/cm/cmr7.pfb><d:/Users/Forest/AppData/Local/Programs/MiKTeX/f
onts/type1/public/amsfonts/cm/cmsy10.pfb><d:/Users/Forest/AppData/Local/Program
s/MiKTeX/fonts/type1/public/amsfonts/cm/cmti10.pfb><d:/Users/Forest/AppData/Loc
al/Programs/MiKTeX/fonts/type1/public/amsfonts/cm/cmtt8.pfb>
Output written on exercises.pdf (2 pages, 150128 bytes).
PDF statistics:
67 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
13 words of extra memory for PDF output out of 10000 (max. 10000000)
Binary file not shown.
Binary file not shown.
+134
View File
@@ -0,0 +1,134 @@
\documentclass [10pt]{article}
\usepackage{latexsym}
\usepackage{amssymb}
\usepackage{epsfig}
\usepackage{fullpage}
\usepackage{enumerate}
\usepackage{xspace}
\usepackage{todonotes}
\usepackage{listings}
\newcommand{\true}{true}
\newcommand{\false}{false}
\usepackage[ruled,linesnumbered]{algorithm2e} % Enables the writing of pseudo code.
\pagestyle{plain}
\bibliographystyle{plain}
\title{192.127 Seminar in Software Engineering (Smart Contracts) \\
SWC-124: Write to Arbitrary Storage Location}
\author{Exercises}
\date{WT 2023/24}
\author{\textbf{*** YOUR NAME AND STUDENT ID ***}}
\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{conjecture}[theorem]{Conjecture}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{example}[theorem]{Example}
\newtheorem{remark}[theorem]{Remark}
\newtheorem{exercise}[theorem]{Exercise}
\renewcommand{\labelenumi}{(\alph{enumi})}
\usepackage{xcolor}
\definecolor{codegreen}{rgb}{0,0.6,0}
\definecolor{codegray}{rgb}{0.5,0.5,0.5}
\definecolor{codepurple}{rgb}{0.58,0,0.82}
\definecolor{backcolour}{rgb}{0.95,0.95,0.92}
\lstdefinestyle{mystyle}{
backgroundcolor=\color{backcolour},
commentstyle=\color{codegreen},
keywordstyle=\color{magenta},
numberstyle=\tiny\color{codegray},
stringstyle=\color{codepurple},
basicstyle=\ttfamily\footnotesize,
breakatwhitespace=false,
breaklines=true,
captionpos=b,
keepspaces=true,
numbers=left,
numbersep=5pt,
showspaces=false,
showstringspaces=false,
showtabs=false,
tabsize=2
}
\begin{document}
\maketitle
\section{Weakness and consequences}
\subsection{Solidity storage layout}
Any contract's storage is a continuous 256-bit address space consisting of 32-bit values. In order to implement dynamically sized data structures like maps and arrays, Solidity distributes their entries in a pseudo-random location. Due to the vast 256-bit range of addresses collisions are statistically extremely improbable and of no practical relevance.
\medspace
In the case of a dynamic array at variable slot $p$, data is written to continuous locations starting at $keccak(p)$. The array itself contains the length information. It is worth noting that Solidity does not come with utility functions to manipulate arrays, and the developer is required to correctly maintain the length value in order to keep track of the array's state.
\medspace
For maps stored in variable slot $p$ the data for index $k$ can be found at $keccak(k . p)$ where $.$ is the concatenation operator.
\subsection{The Weakness}
Any unchecked array write is potentially dangerous, as the storage-location of all variables is publicly known and an unconstrained array index can be reverse engineered to target them.
\lstset{style=mystyle}
\begin{algorithm}
\begin{lstlisting}[language=Octave]
pragma solidity 0.4.25;
contract MyContract {
uint[] private arr;
address private owner;
function write(unit index, uint value) {
arr[index] = value;
}
}
\end{lstlisting}
\caption{A completely unchecked array write}
\label{alg:agf-opt-merge}
\end{algorithm}
In the case of dynamic arrays an improper constraint of the $length$ can be dangerous. As $length$ is unsigned, it is possible to underflow it past $2^{256} - 1$ by decrementing the length below zero, thereby effectively marking the whole address space as part of it.
\section{Vulnerable contracts in literature}
collect vulnerable contracts used by different papers to motivate/illustrate the weakness
\section{Code properties and automatic detection}
summarize the code properties that tools are looking for so that they can detect the weakness
\section{Exploit sketch}
sketch ways to potentially exploit the different variants of the weakness.
%remove this later%
\cite{10.1145/3243734.3243780}
\cite{10.1145/3578527.3578538}
\cite{217464}
\cite{9678888}
\bibliography{exercise.bib}
\end{document}