|
@@ -27,6 +27,8 @@
|
27
|
27
|
\usepackage{booktabs}
|
28
|
28
|
\usepackage{url}
|
29
|
29
|
\usepackage{xcolor}
|
|
30
|
+\usepackage{graphicx}
|
|
31
|
+\graphicspath{ {./} }
|
30
|
32
|
|
31
|
33
|
\definecolor{codegreen}{rgb}{0,0.6,0}
|
32
|
34
|
\definecolor{codegray}{rgb}{0.5,0.5,0.5}
|
|
@@ -110,6 +112,22 @@
|
110
|
112
|
Examples follow, use in production at your own risk ;)
|
111
|
113
|
\end{frame}
|
112
|
114
|
|
|
115
|
+\begin{frame}[fragile]
|
|
116
|
+ \frametitle{Why this works}
|
|
117
|
+ A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$.
|
|
118
|
+
|
|
119
|
+ For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$.
|
|
120
|
+
|
|
121
|
+ An attacker can use this information to overwrite any storage slot by finding an appropriate offset value.
|
|
122
|
+\end{frame}
|
|
123
|
+
|
|
124
|
+\begin{frame}[fragile]
|
|
125
|
+ \frametitle{Why this works}
|
|
126
|
+
|
|
127
|
+ \includegraphics[width=\textwidth]{storage}
|
|
128
|
+
|
|
129
|
+\end{frame}
|
|
130
|
+
|
113
|
131
|
\subsection[Examples]{Examples}
|
114
|
132
|
\begin{frame}[fragile]
|
115
|
133
|
\frametitle{Unchecked Array Write}
|
|
@@ -194,14 +212,7 @@ contract MyContract {
|
194
|
212
|
\end{lstlisting}
|
195
|
213
|
\end{frame}
|
196
|
214
|
|
197
|
|
-\begin{frame}[fragile]
|
198
|
|
- \frametitle{Why this works}
|
199
|
|
- A dynamic array in storage slot $p$ stores its data at continuous addresses starting at $keccak(p)$.
|
200
|
|
-
|
201
|
|
- For example, if the variable $x$ is a dynamic array occupying storage slot 3, $x[o]$ can be found at $keccak(0x3)+o$.
|
202
|
|
-
|
203
|
|
- An attacker can use this information to overwrite any storage slot by finding an appropriate offset value.
|
204
|
|
-\end{frame}
|
|
215
|
+
|
205
|
216
|
|
206
|
217
|
\section{Detecting and Exploiting}
|
207
|
218
|
\subsection[Detecting SWC-124]{Detecting SWC-124}
|
|
@@ -234,6 +245,13 @@ contract MyContract {
|
234
|
245
|
\end{itemize}
|
235
|
246
|
\end{frame}
|
236
|
247
|
|
|
248
|
+\begin{frame}[fragile]
|
|
249
|
+ \texttt{\$ slither Bethorde.sol --print variable-order}
|
|
250
|
+
|
|
251
|
+ \includegraphics[width=\textwidth]{slither}
|
|
252
|
+
|
|
253
|
+\end{frame}
|
|
254
|
+
|
237
|
255
|
\subsection[Exploiting SWC-124]{Exploiting SWC-124}
|
238
|
256
|
|
239
|
257
|
% TODO: Exploitation is trivial, should we just go back and explain or should we go into memory layout? Can we handle it in time?
|