Browse Source

Expand unchecked assembly description

master
Ivaylo Ivanov 1 year ago
parent
commit
e0bffaf8fe
2 changed files with 8 additions and 2 deletions
  1. BIN
      SemSEpaper/exercises.pdf
  2. 8
    2
      SemSEpaper/exercises.tex

BIN
SemSEpaper/exercises.pdf View File


+ 8
- 2
SemSEpaper/exercises.tex View File

215
 The developer has added the \texttt{setNextManager} function, which should set the top of the stack to the latest user as a manager.
215
 The developer has added the \texttt{setNextManager} function, which should set the top of the stack to the latest user as a manager.
216
 The issue is that the function is implemented in such a way, that the stack would not grow, but the first element would always be overwritten - this arises from the fact that the memory slot
216
 The issue is that the function is implemented in such a way, that the stack would not grow, but the first element would always be overwritten - this arises from the fact that the memory slot
217
 of the managers mapping does not point to the memory address on the top of the stack, but instead to the base of it.
217
 of the managers mapping does not point to the memory address on the top of the stack, but instead to the base of it.
218
-The function is then using this slot address directly, without calculating any offset, overwriting the base of the stack.
219
-
218
+The function is then using this slot address directly, without calculating any offset, overwriting the base of the stack. If social engineeering is applied, an attacker can persuade the
219
+owner to set them as a manager, which would result in the weakness being exploited directly and the owner giving up their own management rights.
220
+\subsection{Consequences}
221
+
222
+The consequences of exploiting an arbitrary storage access weakness can be of different types and severity.
223
+An attacker may gain read-write access to private contract data, which should only be accessible to owners, maintainers etc.
224
+They may also exploit the contract to circumvent authorization checks and drain the contract funds.
225
+%TODO: can we expand this?
220
 
226
 
221
 \section{Vulnerable contracts in literature}
227
 \section{Vulnerable contracts in literature}
222
 
228
 

Loading…
Cancel
Save