diff --git a/SemSEpresentation/slides.pdf b/SemSEpresentation/slides.pdf index ba51e6c..32b8f49 100644 Binary files a/SemSEpresentation/slides.pdf and b/SemSEpresentation/slides.pdf differ diff --git a/SemSEpresentation/slides.tex b/SemSEpresentation/slides.tex index 587412a..994c93f 100644 --- a/SemSEpresentation/slides.tex +++ b/SemSEpresentation/slides.tex @@ -27,6 +27,8 @@ \usepackage{booktabs} \usepackage{url} \usepackage{xcolor} +\usepackage{graphicx} +\graphicspath{ {./} } \definecolor{codegreen}{rgb}{0,0.6,0} \definecolor{codegray}{rgb}{0.5,0.5,0.5} @@ -110,6 +112,22 @@ Examples follow, use in production at your own risk ;) \end{frame} +\begin{frame}[fragile] + \frametitle{Why this works} + A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$. + + For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$. + + An attacker can use this information to overwrite any storage slot by finding an appropriate offset value. +\end{frame} + +\begin{frame}[fragile] + \frametitle{Why this works} + + \includegraphics[width=\textwidth]{storage} + +\end{frame} + \subsection[Examples]{Examples} \begin{frame}[fragile] \frametitle{Unchecked Array Write} @@ -194,14 +212,7 @@ contract MyContract { \end{lstlisting} \end{frame} -\begin{frame}[fragile] - \frametitle{Why this works} - A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$. - - For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$. - - An attacker can use this information to overwrite any storage slot by finding an appropriate offset value. -\end{frame} + \section{Detecting and Exploiting} \subsection[Detecting SWC-124]{Detecting SWC-124} @@ -234,6 +245,13 @@ contract MyContract { \end{itemize} \end{frame} +\begin{frame}[fragile] + \texttt{\$ slither Bethorde.sol --print variable-order} + + \includegraphics[width=\textwidth]{slither} + +\end{frame} + \subsection[Exploiting SWC-124]{Exploiting SWC-124} % TODO: Exploitation is trivial, should we just go back and explain or should we go into memory layout? Can we handle it in time? diff --git a/SemSEpresentation/slither.jpg b/SemSEpresentation/slither.jpg new file mode 100644 index 0000000..7071956 Binary files /dev/null and b/SemSEpresentation/slither.jpg differ diff --git a/SemSEpresentation/storage.jpg b/SemSEpresentation/storage.jpg new file mode 100644 index 0000000..20d62b7 Binary files /dev/null and b/SemSEpresentation/storage.jpg differ